Open-source alternatives to FSecureLABS C3

Havoc is a post-exploitation framework used for red team operations. It provides a centralized command and control system for managing remote agents through persistent network connections and customizable communication profiles. The framework focuses on security evasion and stealth, utilizing indirect syscall execution, return address spoofing, and hardware-breakpoint patching to bypass endpoint detection and response tools. It includes a payload generation workflow to create executable shellcode or DLLs for initial remote access. The system covers a broad range of operational capabilities,

This project is intended to serve as reference when designing Cobalt Strike Malleable C2 profiles.

SourcePoint is a polymorphic C2 profile generator for Cobalt Strike C2s, written in Go. SourcePoint allows unique C2 profiles to be generated on the fly that helps reduce our Indicators of Compromise ("IoCs") and allows the operator to spin up complex profiles with minimal effort. This was done…

RedGuard - Excellent C2 Front Flow Control tool

Skyhook is a REST-driven utility used to smuggle files into and out of networks defended by IDS implementations. It comes with a pre-packaged web client that uses a blend of React, vanilla JS, and web assembly to manage file transfers.

Pupy is a command and control framework and post-exploitation suite used for remote administration and system management. It functions as a cross-platform tool for deploying payloads and controlling multiple remote agents through encrypted communication channels. The framework features a multi-platform payload generator that creates custom executable files using configurable network launchers. It employs a network traffic obfuscator that stacks encryption and obfuscation protocols to hide communication from observation. The system provides capabilities for in-memory code execution, remote pr

An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR

A post exploitation framework designed to operate covertly on heavily monitored environments

Authors Joe Vest (@joevest) & Andrew Chiles (@andrewchiles)

Merlin is a cross-platform command and control framework and remote access tool. It provides a server and agent system for post-exploitation coordination, utilizing an HTTP/2 framework for secure communication and the execution of commands across multiple operating systems. The project features an in-memory code execution engine that runs assemblies and shellcode directly within a process to avoid writing files to disk. It implements a decentralized communication architecture through a peer-to-peer network, allowing agents to exchange data via direct bind or reverse connections. To evade det

dnscat2 is a DNS tunneling tool and covert command and control server that encapsulates encrypted traffic within DNS queries and responses. It functions as an encrypted DNS proxy designed to bypass network firewalls and establish communication paths when standard outbound ports are blocked. The project enables the creation of covert network channels by acting as an authoritative nameserver. It supports remote command execution through interactive shells and provides a mechanism for tunneling TCP network traffic to reach restricted remote hosts. The system includes capabilities for multiplexe

Redirect Rules Generation Tool.

Sliver is a command and control framework designed for adversary emulation and security assessment operations. It provides a centralized platform for managing remote systems, enabling security professionals to coordinate multi-operator sessions and maintain persistent, secure communication channels across diverse network environments. The framework distinguishes itself through its focus on stealth and infrastructure flexibility. It utilizes dynamic payload obfuscation to generate unique binaries and supports in-memory execution to minimize disk artifacts. Communication is secured through mutu

(previously known as proxy2's malleableredirector_ plugin)

Covenant is a .NET-based command and control framework designed for red team operations and adversary simulation. It serves as a collaborative platform for coordinating security assessments, managing remote implants, and executing tasks on compromised systems through a centralized server. The project is distinguished by its dynamic payload generator, which compiles and obfuscates executable binaries and scripts on the fly to bypass detection. It further separates itself through a collaborative environment that allows multiple authenticated operators to share a synchronized state, track operat

Empire is a post-exploitation command-and-control (C2) framework designed for red team operations. It deploys and manages agents written in PowerShell, Python, C#, Go, and C across Windows, Linux, and macOS, using encrypted communication channels over HTTP, HTTPS, and SMB. The framework executes over 400 built-in modules for reconnaissance, privilege escalation, credential theft, and lateral movement, and provides a modular engine for authoring custom attack modules. What sets Empire apart is its multi-language agent deployment system, which allows operators to choose implants that suit each

` .....---... ..-'-. .--' '--.. .-' ( 0) Y'' ''-.. (---.., '-. ---.,.-\ \----......./ /..------..._ '-. / / / / \ \ \ \ -. \ (((-' (((-' (((---' (((--- ) / .-'.-' Chameleon: @domchell, MDSec ActiveBreach (-, `

Release blog: GraphStrike: Using Microsoft Graph API to Make Beacon Traffic Disappear Developer blog: GraphStrike: Anatomy of Offensive Tool Development

PoshC2 is a proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral movement.

AzureC2Relay is an Azure Function that validates and relays Cobalt Strike beacon traffic by verifying the incoming requests based on a Cobalt Strike Malleable C2 profile. Any incoming requests that do not share the profiles user-agent, URI paths, headers, and query parameters, will be redirected…

Cobalt Strike External C2 Integration With Azure Servicebus, C2 traffic via Azure Servicebus

C2concealer is a command line tool that generates randomized C2 malleable profiles for use in Cobalt Strike.