# Command Control C2 Infrastructure

> Use when building C2 infrastructure for red teams.

- Skill: `loopyluci/command-control-c2-infrastructure` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/command-control-c2-infrastructure`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/command-control-c2-infrastructure/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/command-control-c2-infrastructure

---


# Command and Control (C2) Infrastructure

Building C2 infrastructure for red team operations — from C2 frameworks (Mythic, Sliver, Cobalt Strike) through redirectors, domain fronting, and opsec.

## When to Use

- Setting up C2 infrastructure for red team engagements
- Choosing between C2 frameworks (Mythic, Sliver, Cobalt Strike, Havoc)
- Implementing domain fronting and CDN redirectors
- Opsec-safe C2 communication

## C2 Architecture

```python
C2_FRAMEWORKS = {
    'mythic': 'Open-source, multi-agent (Apollo, Poseidon, Athena), web UI, extensible',
    'sliver': 'Open-source, Go-based, mTLS/HTTP(S)/DNS, game-over-254d, Github stars',
    'cobalt_strike': 'Commercial — Malleable C2, TCP/HTTP/DNS/SMB, aggressor scripts',
    'havoc': 'Open-source C2 with Cobalt Strike-like features, NtCreateThreadEx injection',
}

C2_INFRA = {
    'redirector': 'Nginx/Apache reverse proxy, filters by User-Agent, Cookie, URI path',
    'domain_fronting': 'CDN hosting (Cloudflare, Azure, CloudFront), HTTPS to CDN != final host',
    'c2_profiles': 'Malleable C2 profiles (Cobalt Strike) — mimic legit traffic (JQuery, API, JS)',
    'callback_intervals': 'Jitter 20-30%, intervals 30-60s, weekend/holiday suppression',
}

# Nginx redirector config template
NGINX_REDIRECTOR = """
server {
    listen 443 ssl;
    server_name legitimate-domain.com;
    
    location / {
        # Forward only valid C2 requests
        if ($http_user_agent !~* "Mozilla|Chrome") { return 404; }
        proxy_pass https://actual-c2-server:443;
    }
}
"""
```

## Verification Checklist

- [ ] C2 framework chosen (Mythic, Sliver, Cobalt Strike, or Havoc)
- [ ] Redirector(s) deployed and tested (domain fronting or CDN)
- [ ] C2 profile configured (malleable C2 to mimic normal traffic)
- [ ] Multiple fallback endpoints (HTTPS, DNS, SMB, custom protocol)
- [ ] Callback intervals and jitter configured
- [ ] Opsec: burn-after-use domains, short-lived certificates
- [ ] Egress filtering tested (what protocols work from target network)
- [ ] P2P mode configured (if agents should talk through each other)
- [ ] Logging and data collection operational