Cobalt Strike's ExternalC2 framework
ExternalC2 is a specification/framework introduced by Cobalt Strike, which allows hackers to extend the default HTTP(S)/DNS/SMB C2 communication channels offered. Essentially this works by allowing the user to develop a number of components: Third-Party Controller - Responsible for creating a connection to the Cobalt Strike TeamServer, and communicating with a Third-Party Client on the target host using a custom C2 channel. Third-Party Client - Responsible for communicating with the Third-Party Controller using a custom C2 channel, and relaying commands to the SMB Beacon. SMB Beacon - The standard beacon which will be executed on the victim host. Using the diagram from CS’s documentation, we can see just how this all fits together.
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
RTA provides a framework of scripts for blue teams to test detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK.
A set of commands for exploit developers and reverse-engineers to enhance GDB functionality.
A reminder that technology alone is not enough to stay secure against social engineering tactics.
A guide on basic Linux privilege escalation techniques including enumeration, data analysis, exploit customization, and trial and error.
Performs network mapping of attack surfaces and external asset discovery using open source information gathering and active reconnaissance techniques.
An exploration of a new method to abuse DCOM for remote payload execution and lateral movement.
Emulate offensive attack techniques in the cloud with a self-contained Go binary.
A powerful enumeration tool for discovering assets and subdomains.
PINNED
Mandos
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.