inesusvet / ttpforge

The TTPForge is a Framework created to facilitate the development, automation, and execution of Tactics, Techniques, and Procedures (TTPs).

TTPForge

This repo hosts the TTPForge tool created by Meta's Purple Team. It is intended to provide an interface to execute TTPs across various targets and mediums.

---

Table of Contents

• Getting Started - User
• Getting Started - Developer
• Using the TTPForge Dev Container
• Code Standards
• Creating a new release

---

Getting started as a user

1. Get latest TTPForge release:

   bashutils_url="https://raw.githubusercontent.com/l50/dotfiles/main/bashutils"
   
   bashutils_path="/tmp/bashutils"
   
   if [[ ! -f "${bashutils_path}" ]]; then
      curl -s "${bashutils_url}" -o "${bashutils_path}"
   fi
   
   source "${bashutils_path}"
   
   fetchFromGithub "facebookincubator" "TTPForge" "latest" ttpforge

   At this point, the latest ttpforge release should be in $HOME/.local/bin/ttpforge and subsequently, the $USER's $PATH.

   If running in a stripped down system, you can add TTPForge to your $PATH with the following command:

   export PATH=$HOME/.local/bin:$PATH

2. Initialize TTPForge configuration

   This command will place a configuration file at the default location ~/.ttpforge/config.yaml and download the ForgeArmory TTPs repository:

   ttpforge init

3. List available TTP repositories (should show forgearmory)

   ttpforge list repos

4. List available TTPs that you can run:

   ttpforge list ttps

5. Examine an example TTP:

   ttpforge show ttp forgearmory//examples/args/define-args.yaml

6. Run the specified example:

   ttpforge run \
     forgearmory//examples/args/define-args.yaml \
     --arg a_message="hello" \
     --arg a_number=1337