RedTeam_BlueTeam_HW: a reading list for Chinese cyber range exercises

An index of drill material, not an application

The repository's own description says it in plain terms: material and tooling related to red-blue confrontation and the annual security drill, covering in-memory shellcode from Cobalt Strike and Metasploit along with memory-webshell detection tools. The repository topics are `blueteam`, `hw`, `pentest-tool` and `readteam`, and GitHub records the language as Java, which reflects the prebuilt jars rather than any source the project maintains.

What is actually in the tree is documents, archives and executables:

├── Blue_Tools
├── LICENSE
├── README.md
├── Red_Tools
├── hostnamePot.jar
├── hw
├── main.md
└── script

There is no build system, no test suite and no source directory. The MIT licence covers the listing and the author's own notes. The repository has 2,641 stars, 583 forks and no open issues, and the last push was on 2026-08-11.

So the honest characterisation is a curated and well-organised archive. That is a real contribution for people preparing for these exercises, because the material is scattered across Chinese-language blogs, vendor report pages and closed communities, and someone has already collected it.

The defensive tool directory

The blue side of the tree is short, and every entry is a prebuilt binary with no source:

├── Blue_Tools
│   ├── BlueTeam_ABC_123.jar
│   ├── CobaltStrikeScan.exe
│   ├── DuckMemoryScan.exe
│   └── LiqunShield.7z

The names describe intent rather than implementation. `CobaltStrikeScan.exe` and `DuckMemoryScan.exe` are memory scanners, which lines up with a document elsewhere in the repository about detecting Cobalt Strike by its in-memory signatures, and with the description's claim about in-memory shellcode. `BlueTeam_ABC_123.jar` is a jar, so it is a Java tool of some kind, and `LiqunShield.7z` is an archive whose contents the README does not describe.

None of this can be evaluated from the outside. You cannot read the code, you cannot tell which Java version a jar expects, and you cannot confirm what a `.exe` does before running it. That is a genuine limitation for a defensive toolkit: the useful thing about a memory scanner is its detection coverage, and none of that is documented here.

A separate `script/` directory holds a single Windows batch file, `winSensorCheck.bat`, which is at least readable in a text editor before you decide to execute it.

The offensive directory and why its shape tells you something

The red side is larger and tells you more about how the material was gathered:

├── Red_Tools
│   ├── TPScan.jar
│   ├── ThinkphpGUI-1.3-SNAPSHOT.jar
│   ├── Windows
│   │   ├── NoApiUser.exe
│   │   └── win.md
│   ├── readme.md
│   └── LiqunKit 综合漏洞利用工具.7z

Two things are worth noting. First, the filenames are a mix of Chinese and English, which is characteristic of tools distributed in Chinese-language security communities rather than published projects. Second, `ThinkphpGUI-1.3-SNAPSHOT.jar` carries a snapshot version marker, meaning the archive is a build of software that was never given a release. That is a useful signal about provenance for anything you find in this directory.

The presence of a `win.md` beside `NoApiUser.exe` shows the author's habit of pairing a binary with notes, which is better than a bare archive but still leaves the binary unverified. The `hostnamePot.jar` at the repository root is the one offensive artifact outside the directory, and its name suggests a host name collection utility.

Read these as reference material about what tools exist in this ecosystem. Running unknown offensive binaries is a different activity with a different risk profile.

The document library is the real payload

The `hw/` directory is where the substance is, and the filenames are self-describing because they carry full titles in Chinese. Among the items listed are a 2020 September security monitoring report on high-risk vulnerability use during the drill, a 2021 reference document summarising defender experience, a 2021 red team field manual, a practical guide to enterprise red-blue confrontation from a Chinese vendor, a document on tracing and counteracting multi-person attacks, and papers on Tomcat filter-type memory shells and their detection.

Two of those are technically specific enough to be worth naming as the most valuable items for a working defender. The Tomcat filter memory shell paper covers a class of attack that has caused real incidents and is genuinely hard to detect, because the payload lives in memory rather than on disk. The Sysmon usage summary is a practical configuration guide for the one Windows tool that most of these response checklists depend on.

The other recurring theme is emergency response. There is a Windows intrusion check procedure, an emergency response summary document, and a Linux emergency handling manual covering the tooling. These translate directly into runbooks you could adapt.

The distinction between offensive and defensive documents is not always clean. One file is titled from the red team perspective on building a defence system, and another from the blue team perspective on breaking through a defence system, which is a fair sign of how this material was assembled.

A second archive with ten numbered categories

The README also documents a separate archive, `HVV资料.7z`, with ten numbered categories and 82 files. The numbering is a reading order, and it is the most usable thing in the whole repository because it stages the material by job:

├── 1.自我排查
├── 2.安全运营
├── 3.研判分析
├── 4.溯源反打
├── 5.HVV必备报告模板
├── 6.历年护网总结
├── 7.防御必备
├── 8.应急响应
├── 9.护网行动培训材料
└── 更多HW资料.txt

Category 1 is self-assessment before the drill, with Linux and Windows hardening handbooks and pre-drill asset collection. Categories 2 and 3 cover security operations and log and traffic analysis. Category 4 is attack tracing and counter-attack, including MySQL honeypot packages for Linux and Windows and a set of documents on tracing attackers through server logs. Category 5 is report templates, which tells you this material is aimed at people who have to write the after-action report. Category 9 is the largest, a numbered training series running from an overview through asset inventory, vulnerability scanning standards, hardening standards, and platform-specific training for threat intelligence, situational awareness, IPS, WAF and log analysis.

Reading that series in order is the closest thing here to a curriculum. Several items are `.url` shortcut files rather than documents, which means their content depends on external links that may no longer resolve.

Editorial conclusion

This repository is best understood as an index rather than a project. The value is in knowing that a specific drill report, an emergency response checklist or a Tomcat memory-shell analysis exists and where to start reading, and the file tree is organised clearly enough to make that lookup fast. What it is not is a place to learn offensive technique from, since most of the substance sits inside PDFs and prebuilt executables whose behaviour you cannot inspect. Treat the tool directories as objects of study rather than things to run on a workstation, and read the documents yourself instead of trusting an archive index. Start with the defensive material and the emergency response checklists, because those translate directly to work you can do, and use the offensive sections as background for understanding what an adversary will try.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. Mr-xn/RedTeam_BlueTeam_HW on GitHub
4. README