domains / families / security / building-c2-redirector-infrastructure

building-c2-redirector-infrastructure

separate

Build dumb-pipe and traffic-filtering C2 redirectors with nginx (proxy_pass) and Apache (mod_rewrite), deriving filter rules from a Malleable C2 profile, layering Let's Encrypt TLS, and applying OPSEC controls like domain fronting and UA/geo filtering. Use when standing up red-team C2 that must survive blue-team triage or ensuring only profile-matching implant traffic reaches the hidden team server.

When to use

• Standing up red-team C2 that must survive blue-team triage and domain takedown requests.
• Separating a hidden team server from any internet-facing host during an engagement.
• Filtering implant traffic so only profile-matching requests reach the backend, diverting scanners.
• Adding TLS termination, domain categorization, and CDN/domain fronting to an HTTP(S) listener.
• Teaching defenders how external-proxy C2 (T1090.002) is constructed so they can detect it.

When not to use

• Deploying redirectors to control malware on systems you are not explicitly authorized to test

Skill page

Source