Framework-uri de Command and Control pentru Red Team
For un framework C2 pentru red teams, the strongest matches are bc-security/empire (Empire is a dedicated post-exploitation C2 framework built for), nathanlopez/stitch (Stitch is an open-source C2 framework and post-exploitation toolkit) and t3l3machus/hoaxshell (Hoaxshell is an open-source C2 framework for Windows remote). n1nj4sec/pupy and mitre/caldera round out the shortlist. Each is ranked by relevance to your query, popularity and recent activity.
Infrastructură și instrumente de comunicare open-source concepute pentru operațiuni red team autorizate și engagement-uri de tip penetration testing.
Framework-uri de Command and Control pentru Red Team
Găsește cele mai bune repo-uri cu AI.Vom căuta cele mai potrivite repository-uri folosind AI.
- bc-security/empire
BC-SECURITY/Empire
5,045Vezi pe GitHubEmpire is a post-exploitation command-and-control (C2) framework designed for red team operations. It deploys and manages agents written in PowerShell, Python, C#, Go, and C across Windows, Linux, and macOS, using encrypted communication channels over HTTP, HTTPS, and SMB. The framework executes over 400 built-in modules for reconnaissance, privilege escalation, credential theft, and lateral movement, and provides a modular engine for authoring custom attack modules. What sets Empire apart is its multi-language agent deployment system, which allows operators to choose implants that suit each
Empire is a dedicated post-exploitation C2 framework built for red team operations, offering multi-language agents (PowerShell, Python, C#, Go, C) across Windows, Linux, and macOS, encrypted communication over HTTP/HTTPS/SMB, payload stagers, and hundreds of built-in modules—making it a comprehensive match for your requirements.
PowerShellEncrypted C2 ProtocolsMalleable C2 Traffic ProfilesPost-Exploitation Module Deployments - nathanlopez/stitch
nathanlopez/Stitch
3,532Vezi pe GitHubStitch is a command and control framework and post-exploitation toolkit designed for managing multiple remote systems from a central server. It functions as a remote administration tool and payload builder, enabling the execution of commands and the deployment of agents across different operating systems. The project features a cross-platform builder for generating custom executable agents with configurable network bindings and boot behaviors. It utilizes encrypted communication channels to secure traffic between the controller and remote clients, and it supports the execution of dynamic scri
Stitch is an open-source C2 framework and post-exploitation toolkit with cross-platform agent generation, encrypted communication channels, and payload building capabilities that directly address the core needs of a red team operations tool.
PythonPayload GenerationCommunication Encryption - t3l3machus/hoaxshell
t3l3machus/hoaxshell
3,421Vezi pe GitHubHoaxshell is a command and control system for Windows remote command execution. It provides a framework for generating and managing reverse shell payloads that utilize an HTTP beaconing protocol, where victim clients periodically poll a handler to receive and execute instructions. The project distinguishes itself through its ability to bypass PowerShell Constrained Language Mode using specialized payload generation. It supports encrypted command and control via TLS certificate injection and provides mechanisms for remote session recovery, allowing a handler to reestablish control over active
Hoaxshell is an open-source C2 framework for Windows remote command execution via encrypted HTTP beaconing, fitting the red-team C2 category but limited to Windows agents and lacking full post-exploitation modules and operator collaboration features.
PythonC2 Beacon Generators - n1nj4sec/pupy
n1nj4sec/pupy
8,942Vezi pe GitHubPupy is a command and control framework and post-exploitation suite used for remote administration and system management. It functions as a cross-platform tool for deploying payloads and controlling multiple remote agents through encrypted communication channels. The framework features a multi-platform payload generator that creates custom executable files using configurable network launchers. It employs a network traffic obfuscator that stacks encryption and obfuscation protocols to hide communication from observation. The system provides capabilities for in-memory code execution, remote pr
Pupy is a cross-platform command-and-control framework that includes encrypted communication, a payload generator, and post-exploitation modules, directly matching the requirements for red team operations.
PythonCommand and Control FrameworksCross-Platform Administration ToolsCross-Platform Management Systems - mitre/caldera
mitre/caldera
7,047Vezi pe GitHubCaldera is an adversary emulation platform and command and control framework designed to simulate cyber attack patterns. It functions as an automated red team tool and threat framework orchestrator, executing attack sequences based on standardized cybersecurity threat frameworks to validate security defenses and detection capabilities. The platform distinguishes itself through the dynamic compilation of customized executable payloads and the use of framework-mapped adversary modeling to structure attack techniques. It manages asynchronous agents on targeted endpoints via a central server acce
Caldera is an open-source adversary emulation platform and C2 framework that generates customizable payloads and manages agents asynchronously, fitting perfectly as a command-and-control framework for authorized red team operations.
PythonCommand and Control PlatformsAdversary Emulation FrameworksAdversary Technique Mappings - bishopfox/sliver
BishopFox/sliver
10,707Vezi pe GitHubSliver is a command and control framework designed for adversary emulation and security assessment operations. It provides a centralized platform for managing remote systems, enabling security professionals to coordinate multi-operator sessions and maintain persistent, secure communication channels across diverse network environments. The framework distinguishes itself through its focus on stealth and infrastructure flexibility. It utilizes dynamic payload obfuscation to generate unique binaries and supports in-memory execution to minimize disk artifacts. Communication is secured through mutu
Sliver is a mature, open-source command-and-control framework built for adversary emulation, with cross-platform agents, encrypted mutual TLS communication, dynamic payload generation, and operator collaboration — exactly what is needed for red team operations.
GoCommand and Control PlatformsAdversary Emulation FrameworksCommand and Control Frameworks - ne0nd0g/merlin
Ne0nd0g/merlin
5,555Vezi pe GitHubMerlin is a cross-platform command and control framework and remote access tool. It provides a server and agent system for post-exploitation coordination, utilizing an HTTP/2 framework for secure communication and the execution of commands across multiple operating systems. The project features an in-memory code execution engine that runs assemblies and shellcode directly within a process to avoid writing files to disk. It implements a decentralized communication architecture through a peer-to-peer network, allowing agents to exchange data via direct bind or reverse connections. To evade det
Merlin is a mature, open-source C2 framework built in Go with cross-platform agents, encrypted HTTP/2 communication, in-memory payload execution, and a rich set of traffic obfuscation and malleability features, making it an excellent fit for red team operations.
GoHTTP/2 Transport LayersC2 AgentsC2 Communication Protocols - havocframework/havoc
HavocFramework/Havoc
8,182Vezi pe GitHubHavoc is a post-exploitation framework used for red team operations. It provides a centralized command and control system for managing remote agents through persistent network connections and customizable communication profiles. The framework focuses on security evasion and stealth, utilizing indirect syscall execution, return address spoofing, and hardware-breakpoint patching to bypass endpoint detection and response tools. It includes a payload generation workflow to create executable shellcode or DLLs for initial remote access. The system covers a broad range of operational capabilities,
Havoc is a full-featured open-source C2 framework purpose-built for red team operations, offering a centralized command server, payload generation, customizable communication profiles, and evasion techniques like indirect syscalls — directly meeting the requirement for an operational C2 platform with encrypted channels and modular post-exploitation capabilities.
GoPost-Exploitation FrameworksC2 Server HostingEvasive Payload Generators - empireproject/empire
EmpireProject/Empire
7,813Vezi pe GitHubEmpire is a command and control framework and post-exploitation toolkit used for network penetration testing. It serves as a centralized platform for coordinating remote agent communication and automating the delivery of security testing payloads to target systems. The project provides a suite of modules for host reconnaissance, lateral movement, and credential harvesting across corporate environments. It functions as a remote administration tool to maintain persistence and execute commands on compromised hosts. The framework incorporates capabilities for agent orchestration and the executio
Empire is a proven open-source command-and-control framework built for penetration testing and red team operations, with encrypted agent communication, extensive post-exploitation modules, and operator logging — squarely the category and covering the key features.
PowerShellPenetration Testing FrameworksAgent OrchestrationC2 Infrastructure - malwaredllc/byob
malwaredllc/byob
9,478Vezi pe GitHubThis project is a post-exploitation framework and command and control platform designed for security research and penetration testing. It functions as a remote access tool consisting of a central command server and encrypted executable payloads that establish reverse shell connections. The system utilizes a web-based dashboard for multi-client administration, allowing for remote host monitoring and direct shell access through an in-browser terminal. It generates cross-platform, encrypted binaries that employ a multi-stage delivery chain and a key exchange mechanism to secure communications.
BYOB is an open-source post-exploitation framework and C2 platform with encrypted cross-platform payloads, a web-based dashboard for multi-agent control, and multi-stage delivery—exactly what you need for authorized red team operations.
PythonC2 Server HostingRemote Access TrojansC2 Listener Servers - powershellempire/empire
PowerShellEmpire/Empire
7,843Vezi pe GitHubEmpire is a post-exploitation framework and command and control server designed to manage remote access agents. It provides a centralized system for coordinating these agents and executing specialized scripts across target systems. The project functions as a security evasion tool by adapting network communication patterns to bypass firewalls and monitoring tools. It utilizes a multi-language agent runtime and a modular plugin architecture to execute payloads across different operating systems. The framework covers a broad range of operational capabilities, including remote agent orchestratio
Empire is a dedicated command-and-control and post-exploitation framework that manages remote agents, supports multi-language runtimes for cross-platform targets, and covers encrypted communication, payload delivery, modular plugins, and evasion — directly matching your C2 requirements for authorized red team operations.
PowerShellCommand and ControlAgent DeploymentAgent Orchestration - rapid7/metasploit-framework
rapid7/metasploit-framework
38,415Vezi pe GitHubThe framework is a comprehensive penetration testing platform designed for the development, testing, and execution of security exploits. It serves as a research toolkit and automated assessment environment, enabling security professionals to identify and validate vulnerabilities within networked systems and infrastructure through repeatable, standardized procedures. The platform distinguishes itself through a modular architecture that supports reflective payload injection, allowing for the execution of code directly in memory without writing to disk. It utilizes an asynchronous event loop to
Metasploit is a penetration testing platform that includes a built-in command-and-control capability through Meterpreter agents, encrypted communications, and modular post-exploitation modules, making it a valid C2 framework for dedicated red team operations despite being broader in scope.
RubyPenetration Testing PlatformsExploit FrameworksExploitation Frameworks - samratashok/nishang
samratashok/nishang
9,951Vezi pe GitHubNishang is a PowerShell-based offensive security framework designed for red teaming and penetration testing on Windows targets. It functions as a post-exploitation toolkit and payload generator to automate attacks and manage remote targets. The project provides specialized capabilities for bypassing security controls, such as disabling the Antimalware Scan Interface and employing in-memory execution to avoid disk-based detection. It includes a variety of stealthy command and control mechanisms, utilizing non-standard channels like DNS TXT records, ICMP traffic, and webmail for communication a
Nishang is a PowerShell-based offensive security framework that provides command and control over non-standard channels like DNS and ICMP, making it a focused C2 tool for Windows red teaming, though its scope is limited to PowerShell agents and lacks cross-platform support.
PowerShellOffensive & Red Team OperationsPost-Exploitation ToolkitsAMSI Bypasses - cobbr/covenant
cobbr/Covenant
4,699Vezi pe GitHubCovenant is a .NET-based command and control framework designed for red team operations and adversary simulation. It serves as a collaborative platform for coordinating security assessments, managing remote implants, and executing tasks on compromised systems through a centralized server. The project is distinguished by its dynamic payload generator, which compiles and obfuscates executable binaries and scripts on the fly to bypass detection. It further separates itself through a collaborative environment that allows multiple authenticated operators to share a synchronized state, track operat
Covenant is a collaborative .NET C2 framework built specifically for red team operations, which directly matches your intent for an open-source command-and-control system.
C#Malleable C2 Traffic ProfilesSecure Network Communication - nettitude/poshc2
nettitude/PoshC2
2,112Vezi pe GitHubPoshC2 is a proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral movement.
PoshC2 is an open-source C2 framework built for red teaming, post-exploitation, and lateral movement, which directly fits the category; it is proxy-aware and covers core C2 features, though its PowerShell-centric agents mean it is narrower in scope than some alternatives.
PowerShellCommand and ControlCommand and ControlCommand And Control Frameworks - funnywolf/viper
FunnyWolf/Viper
4,964Vezi pe GitHubViper is a command and control infrastructure manager and post-exploitation framework designed for adversary attack simulation and security assessment. It functions as an orchestrator for penetration testing, combining a system for managing compromised hosts across multiple operating systems with tools for security workflow automation. The platform is distinguished by its use of large language model agents to coordinate red team tasks, automate data processing, and provide intelligent decision support. It includes a network pivot visualizer that uses directional graphs to map relationships an
Viper is explicitly a command-and-control infrastructure manager and post-exploitation framework for red team operations, so it squarely fits the category you are searching for, though the description lacks explicit mention of encrypted communication channels and malleable C2 profiles, which are among the features you listed.
C2 Infrastructure ManagersAgent Task OrchestratorsAI-Driven Penetration Testing
