# RTExit — Red Team Exit Framework

> AI-Assisted Red Team Methodology — From Beginner to Expert

---

## What is RTExit?

RTExit is a complete, AI-assisted Red Team methodology framework built on the same architecture as BMAD-METHOD. It provides structured **Agents**, **Skills**, and **Attack Scenarios** for every phase of a Red Team engagement — from pre-engagement planning to final report delivery.

**Covers:**
- 🌐 Web Applications (OWASP WSTG full)
- 📱 Mobile — Android & iOS (OWASP MASVS full)
- 💻 Desktop — Electron, Windows (.NET/Win32), macOS
- 🔌 Network & Infrastructure
- 🏢 Active Directory / Windows AD
- ☁️ Cloud — AWS, Azure, GCP
- 🎭 Social Engineering & Phishing
- 🔒 Physical Security
- 📡 IoT / Firmware / SCADA
- 🗄️ Databases — MySQL, PostgreSQL, MSSQL, MongoDB, Redis, Firebase

---

## Quick Start

```bash
npx rtexit-method install
```

Website: `https://www.exitcode.me/`
Repository: `https://github.com/exit-code-eg/RTExit`

The installer will:

- show the RTExit banner
- ask for language and skill-level choices
- install RTExit assets only
- create or update `_rtexit/config.user.toml`

Then:

1. Open `_rtexit/config.user.toml`
2. Complete your operator and engagement details
3. Open your AI IDE in the project
4. Start with `rt-help`

---

## The 7 Agents

| Agent | Name | Icon | Domain |
|-------|------|------|--------|
| Commander | Ahmed | 🎯 | Strategy, Scope, Planning |
| Scout | Nour | 🔭 | Reconnaissance & OSINT |
| Breaker | Karim | 💀 | Web, API, Languages, Databases |
| Navigator | Rami | 📱 | Mobile, Desktop, IoT |
| Ghost | Sara | 👻 | Post-Exploitation, AD, Cloud |
| Phantom | Omar | 🎭 | Social Engineering, Physical |
| Scribe | Layla | 📝 | Reporting, Evidence, Auto-Docs |

---

## The 4 Phases

```
Phase 1: PLANNING        → Scope, SEAD, Threat Model, Methodology
Phase 2: RECONNAISSANCE  → OSINT, Subdomains, Attack Surface
Phase 3: EXPLOITATION    → Web, Mobile, Network, Cloud, Social, Post-Exploitation
Phase 4: REPORTING       → Findings, CVSS, MITRE, Reports, Remediation
```

---

## Skill Levels

Every skill supports 4 levels:
- **BEGINNER** — Step-by-step with explanations, safe tools
- **INTERMEDIATE** — Methodology focus, standard tools
- **ADVANCED** — OPSEC-aware, stealth techniques
- **EXPERT** — Custom exploitation, vulnerability research

---

## Engagement Output Structure

All documentation is auto-generated in `_rtexit-output/docs/`:

```
docs/
├── engagement/    → SEAD, scope, timeline, contacts
├── reconnaissance/→ subdomains, attack-surface, employees
├── findings/      → findings-master.csv + individual F-XXX.md files
├── evidence/      → screenshots, terminal-logs, chain-of-custody
├── attack-chains/ → multi-step paths, MITRE map
└── reports/       → executive + technical + remediation
```

---

## Frameworks Supported

| Framework | Domain |
|-----------|--------|
| PTES | General purpose (7 phases) |
| NIST SP 800-115 | Compliance-driven |
| OWASP WSTG | Web applications |
| OWASP MASVS | Mobile applications |
| TIBER-EU | Financial institutions |
| CBEST | UK financial sector |
| MITRE ATT&CK | Adversary behavior mapping |
| Cyber Kill Chain | Attack phase mapping |

---

## Resources

- PayloadsAllTheThings: github.com/swisskyrepo/PayloadsAllTheThings
- HackTricks: hacktricks.wiki
- SecLists: github.com/danielmiessler/SecLists
- OWASP WSTG: owasp.org/www-project-web-security-testing-guide
- MITRE ATT&CK: attack.mitre.org
- CVSS 4.0: first.org/cvss/v4-0

---

*RTExit — Red Team Methodology Framework | 2026*
