1_RTO — Index

BLUF. Offensive tradecraft for authorized lab and assessment work — course spine (OW64), web, cloud, tunneling, reference syntaxes, Kubernetes, and wireless lab notes.

Shelves

#	Folder	Entry	Role
1.1	`1.1 Red Teaming 101/`	Red Teaming 101 — Index	Master course — Linux, AD, C2, EDR, reporting, recon
1.2	`1.2 Web/`	Web — Index	Architecture, validation catalog, attack references, and Web3
1.3	`1.3 Clouds/`	Clouds — Index	Cloud fundamentals and bounded AWS / Azure / GCP validation
1.4	`1.4 Tunneling/`	Tunneling — Index	Managed forwarding and restricted tunnel references
1.5	`1.5 Syntaxes/`	Syntax References — Index	Short administrative and lab references
1.6	`1.6 Kubernetes/`	Kubernetes — Index	Architecture and validation catalog; legacy attack guide held
1.7	`1.7 Wireless/`	Wireless and SDR — Index	Passive and contained lab validation
	`Docker/`	Docker — Index	Restricted local container workspaces

Unnumbered at shelf root: Bounded authorized service validation remains a cross-shelf network reference. Number or merge it into the networking track during a future structural pass.

1.1 Red Teaming 101 — pillar order

Pillar	Note
Initial access	0.4 Initial Access
Linux	1. Linux
Windows / AD	2. Windows AD
Web (hub)	→ 1.2 Web learn track
Networking	4. Networking · 4.1 Pivoting
Cloud (hub)	→ 1.3 Clouds
EDR	6. EDR
C2	7. C2
Reporting	8. Reporting
Recon lab	Recon — External

Also under 1.1: 1.1.2 Infra/ (lab build scripts), backup/ (archive), 1.1.1 OW64/Recon/noise-lab/ (artifact outputs).

1.2 Web — tracks

Track	Path
Learn	`1.2.1 Learn Web/` (0–11)
Attack	`1.2.2 Attack Web/` (by stack)
Web3	`1.2.3 Web3/Learn Web3/`

1.3 Clouds — tracks

Track	Path
Learn	`1.3.1 Learn Cloud/` (inner `0.1.x` numbering — legacy, deferred)
Attack	`1.3.2 Attack Cloud/` (inner `0.2.x` numbering — legacy, deferred)
Phishing	`Cloud Phishing/`

Cross-shelf

Shelf	Relationship
Platform Internals	Platform depth (Windows mechanics, PE, syscalls, authentication, memory)
4_Domain Playbooks	Domain lab runbooks with evidence
2_AI	AI harnesses, agents, MCP, evaluation, and automation
5_Projects	What to ship and when

Rename note (2026-08-27)

Was	Now
`1. Red Teaming 101/`	`1.1 Red Teaming 101/`
`Web/` + `2.x` children	`1.2 Web/` + `1.2.x`
`Clouds/` + `0.x` children	`1.3 Clouds/` + `1.3.x`
`Tunneling/`, `Syntaxes/`, `Kubernetes/`, `Wireless/`	`1.4`–`1.7`
`1.1 Red Teaming 101/101/`	`1.1 Red Teaming 101/1.1.1 OW64/`
`1.1 Red Teaming 101/Infra/`	`1.1 Red Teaming 101/1.1.2 Infra/`

Inner Cloud paths (0.1.1.1, 0.2.3, PwnedLabs) unchanged — renumber in a later pass.