[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADXT26CPNCPT2PBGERVVCG":3,"skill-same:01M6ADXT26CPNCPT2PBGERVVCG":99},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":54,"commitSha":55,"skillDirectory":56,"forksCount":57,"repositoryHtmlUrl":58,"repositoryHomepageUrl":59,"ownerHtmlUrl":60,"ownerBlogUrl":61,"ownerDescription":62,"updatedAt":63,"install":64,"resources":77},"01M6ADXT26CPNCPT2PBGERVVCG","building-c2-redirector-infrastructure",null,"Build dumb-pipe and traffic-filtering C2 redirectors with nginx (proxy_pass) and Apache (mod_rewrite), deriving filter rules from a Malleable C2 profile, layering Let's Encrypt TLS, and applying OPSEC controls like domain fronting and UA\u002Fgeo filtering. Use when standing up red-team C2 that must survive blue-team triage or ensuring only profile-matching implant traffic reaches the hidden team server.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-c2-redirector-infrastructure\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"building c2 redirector infrastructure","infrastructure","c2","nginx","traffic-filtering","opsec","apache-mod-rewrite","redirector","c2-infrastructure","malleable-c2","cybersecurity","red-team","server","proxy","apache","encrypt","triage","2026-11-10 10:12:30",false,"---\nname: building-c2-redirector-infrastructure\ndescription: Build dumb-pipe and traffic-filtering C2 redirectors with nginx (proxy_pass) and Apache (mod_rewrite), deriving filter rules from a Malleable C2 profile, layering Let's Encrypt TLS, and applying OPSEC controls like domain fronting and UA\u002Fgeo filtering. Use when standing up red-team C2 that must survive blue-team triage or ensuring only profile-matching implant traffic reaches the hidden team server.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- c2-infrastructure\n- redirector\n- nginx\n- apache-mod-rewrite\n- malleable-c2\n- opsec\n- traffic-filtering\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\nmitre_attack:\n- T1090.002\n---\n# Building C2 Redirector Infrastructure\n\n> **Authorized Use Only:** This skill is for authorized red-team engagements, adversary-emulation exercises, and defensive research only. Command-and-control infrastructure is dual-use; deploying redirectors to control malware on systems you are not explicitly authorized to test is illegal. Operate only inside an agreed scope with a signed rules-of-engagement document, and decommission infrastructure when the engagement ends.\n\n## Overview\n\nA C2 redirector is an intermediary host that sits between victim implants and the real team server. Beacons connect to the redirector's public domain\u002FIP; the redirector inspects each request and either proxies legitimate C2 traffic back to the hidden team server or diverts everything else (scanners, blue-team analysts, sandboxes) to a benign decoy site. This protects the team server from discovery, takedown, and attribution, and lets operators rotate the public edge without rebuilding the backend. The technique maps to MITRE ATT&CK **T1090.002 (Proxy: External Proxy)** — adversaries route C2 through an intermediary node to obscure the true origin.\n\nRedirectors come in two flavors. **Dumb pipes** (socat, iptables NAT) blindly forward a port and provide separation but no filtering. **Smart\u002Ffiltering redirectors** (nginx `proxy_pass`, Apache `mod_rewrite` with `[P]`, or purpose-built tools like RedWarden) parse HTTP requests and only forward traffic that matches the implant's Malleable C2 profile — correct URI, User-Agent, headers — while sending everything else a `302` to a real website. The filtering logic is derived directly from the C2 framework's traffic profile, so the two must stay in lock-step. Tools such as `cs2modrewrite` automate generating Apache\u002Fnginx rules from a Cobalt Strike Malleable C2 profile.\n\nThis skill covers building both dumb and filtering redirectors with nginx and Apache, deriving filter rules from a malleable profile, layering TLS with Let's Encrypt, and applying OPSEC controls (categorized domains, domain fronting\u002FCDN fronting, header validation, geo\u002FUA filtering) for resilient, low-attribution infrastructure.\n\n## When to Use\n\n- Standing up red-team C2 that must survive blue-team triage and domain takedown requests.\n- Separating a hidden team server from any internet-facing host during an engagement.\n- Filtering implant traffic so only profile-matching requests reach the backend, diverting scanners.\n- Adding TLS termination, domain categorization, and CDN\u002Fdomain fronting to an HTTP(S) listener.\n- Teaching defenders how external-proxy C2 (T1090.002) is constructed so they can detect it.\n\n## Prerequisites\n\n- One or more disposable cloud VPS instances (the redirector edge) and a separate, firewalled team-server host.\n- A registered domain with controllable DNS, ideally aged\u002Fcategorized.\n- Root on the redirector host. Install the web server and TLS tooling:\n  ```bash\n  # Debian\u002FUbuntu redirector\n  sudo apt update\n  sudo apt install -y nginx apache2 socat certbot python3-certbot-nginx git\n  # Enable Apache proxy modules if using mod_rewrite redirector\n  sudo a2enmod rewrite proxy proxy_http ssl headers\n  ```\n- The C2 framework's Malleable C2 profile (Cobalt Strike `.profile`, Sliver\u002FHavoc HTTP profile) defining URIs, User-Agent, and headers.\n- `cs2modrewrite` to auto-generate rules from a Cobalt Strike profile:\n  ```bash\n  git clone https:\u002F\u002Fgithub.com\u002Fthreatexpress\u002Fcs2modrewrite\n  ```\n- Firewall the team server so it only accepts the redirector's source IP on the C2 port.\n\n## Objectives\n\n- Deploy a dumb-pipe redirector (socat\u002Fiptables) for fast port separation.\n- Deploy a filtering nginx reverse-proxy redirector keyed to a malleable profile.\n- Deploy an Apache `mod_rewrite` redirector with `[P]` proxying and `302` decoy fallback.\n- Auto-generate redirector rules from a Cobalt Strike profile with `cs2modrewrite`.\n- Terminate TLS with Let's Encrypt and harden the public edge.\n- Apply OPSEC: header\u002FUA validation, geo filtering, decoy diversion, and infra rotation.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Official Name | Relevance |\n|--------------|---------------|-----------|\n| T1090.002 | Proxy: External Proxy | The redirector is an external intermediary that proxies C2 to hide the team server |\n| T1090.004 | Proxy: Domain Fronting | CDN fronting routes beacon traffic through a trusted high-reputation domain |\n| T1071.001 | Application Layer Protocol: Web Protocols | C2 is tunneled over HTTP\u002FHTTPS shaped by the malleable profile |\n| T1573.002 | Encrypted Channel: Asymmetric Cryptography | TLS termination at the redirector encrypts the beacon channel |\n| T1583.006 | Acquire Infrastructure: Web Services | Disposable VPS\u002FCDN edges are acquired for resilient C2 |\n\n## Workflow\n\n### 1. Lab and firewall the team server\nPlace the team server on a private host. Restrict its C2 port to the redirector's IP only.\n```bash\n# On the team server: only the redirector (203.0.113.10) may reach 443\u002Ftcp\nsudo ufw default deny incoming\nsudo ufw allow from 203.0.113.10 to any port 443 proto tcp\nsudo ufw allow OpenSSH\nsudo ufw enable\n```\n\n### 2. Dumb-pipe redirector (socat \u002F iptables)\nFor quick separation with no filtering, forward the C2 port to the team server.\n```bash\n# socat foreground forward of 443 -> team server\nsocat TCP4-LISTEN:443,fork,reuseaddr TCP4:10.0.0.2:443\n\n# Or iptables DNAT (persistent)\nsysctl -w net.ipv4.ip_forward=1\niptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination 10.0.0.2:443\niptables -t nat -A POSTROUTING -p tcp -d 10.0.0.2 --dport 443 -j MASQUERADE\n```\n\n### 3. Filtering nginx reverse-proxy redirector\nOnly proxy requests whose URI matches the malleable profile; send everything else a `302` to a decoy. Replace the location regex and User-Agent with values from your profile.\n```nginx\n# \u002Fetc\u002Fnginx\u002Fsites-available\u002Fredirector.conf\nserver {\n    listen 443 ssl;\n    server_name cdn.example.com;\n\n    ssl_certificate     \u002Fetc\u002Fletsencrypt\u002Flive\u002Fcdn.example.com\u002Ffullchain.pem;\n    ssl_certificate_key \u002Fetc\u002Fletsencrypt\u002Flive\u002Fcdn.example.com\u002Fprivkey.pem;\n\n    # Proxy ONLY profile-matching C2 URIs to the hidden team server\n    location ~ ^\u002F(api\u002Fv2\u002Fjobs|cm\u002F[a-z0-9]+|push) {\n        # Require the implant's exact User-Agent\n        if ($http_user_agent != \"Mozilla\u002F5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\u002F537.36\") {\n            return 302 https:\u002F\u002Fwww.legitimate-decoy.com\u002F;\n        }\n        proxy_pass https:\u002F\u002F10.0.0.2;\n        proxy_ssl_verify off;\n        proxy_set_header Host $host;\n        proxy_set_header X-Forwarded-For $remote_addr;\n    }\n\n    # Everything else -> benign decoy\n    location \u002F {\n        return 302 https:\u002F\u002Fwww.legitimate-decoy.com\u002F;\n    }\n}\n```\n```bash\nsudo ln -s \u002Fetc\u002Fnginx\u002Fsites-available\u002Fredirector.conf \u002Fetc\u002Fnginx\u002Fsites-enabled\u002F\nsudo nginx -t && sudo systemctl reload nginx\n```\n\n### 4. Apache mod_rewrite redirector\nApache's `[P]` flag proxies matching requests to the team server; non-matches get a `302` redirect. This is the format `cs2modrewrite` produces.\n```apache\n# \u002Fetc\u002Fapache2\u002Fsites-available\u002Fredirector.conf  (inside \u003CVirtualHost *:443>)\nRewriteEngine On\nSSLProxyEngine On\n# Require the implant User-Agent\nRewriteCond %{HTTP_USER_AGENT} \"Mozilla\u002F5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\u002F537.36\" [NC]\n# Match valid C2 URIs (GET\u002FPOST\u002Fstager) from the malleable profile\nRewriteCond %{REQUEST_URI} ^\u002F(api\u002Fv2\u002Fjobs|cm\u002F[a-z0-9]+|push)\u002F?$\n# Proxy to the hidden team server, preserving the URI\nRewriteRule ^.*$ https:\u002F\u002F10.0.0.2%{REQUEST_URI} [P,L]\n# Everything else -> decoy site\nRewriteRule ^.*$ https:\u002F\u002Fwww.legitimate-decoy.com\u002F [R=302,L]\n```\n```bash\nsudo a2ensite redirector && sudo apache2ctl configtest && sudo systemctl reload apache2\n```\n\n### 5. Generate rules from a malleable profile\nLet `cs2modrewrite` build the Apache or nginx rules directly from your Cobalt Strike profile so the filter exactly matches beacon traffic.\n```bash\ncd cs2modrewrite\n# Apache mod_rewrite rules\npython3 cs2modrewrite.py -i havex.profile -c https:\u002F\u002F10.0.0.2 \\\n  -r https:\u002F\u002Fwww.legitimate-decoy.com -o \u002Fetc\u002Fapache2\u002Fredirect.rules\n# nginx config\npython3 cs2nginx.py -i havex.profile -c https:\u002F\u002F10.0.0.2 \\\n  -r https:\u002F\u002Fwww.legitimate-decoy.com -H cdn.example.com > \u002Fetc\u002Fnginx\u002Fsites-available\u002Fc2.conf\n```\n\n### 6. Terminate TLS with Let's Encrypt\nIssue a valid certificate so beacon HTTPS does not throw TLS warnings and the edge looks legitimate.\n```bash\nsudo certbot --nginx -d cdn.example.com --agree-tos -m ops@example.com --redirect\n# Verify auto-renewal\nsudo certbot renew --dry-run\n```\n\n### 7. Apply OPSEC controls\nLayer defenses against blue-team analysis: validate headers, geofence to the target country, divert sandboxes, and rotate edges. Consider CDN\u002Fdomain fronting (T1090.004) where supported.\n```bash\n# Example: drop non-target geographies at the firewall with ipset\u002FGeoIP,\n# require a custom auth header in the profile, and rotate the redirector\n# domain\u002FIP on a schedule. Check the redirector only forwards matched traffic:\ncurl -k https:\u002F\u002Fcdn.example.com\u002F                       # expect 302 to decoy\ncurl -k -A \"Mozilla\u002F5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\u002F537.36\" \\\n  https:\u002F\u002Fcdn.example.com\u002Fapi\u002Fv2\u002Fjobs                  # expect proxied response\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Source |\n|------|---------|--------|\n| nginx | Filtering reverse-proxy redirector | https:\u002F\u002Fnginx.org\u002F |\n| Apache mod_rewrite | `[P]` proxy + `302` decoy redirector | https:\u002F\u002Fhttpd.apache.org\u002Fdocs\u002Fcurrent\u002Fmod\u002Fmod_rewrite.html |\n| cs2modrewrite | Generate Apache\u002Fnginx rules from CS profile | https:\u002F\u002Fgithub.com\u002Fthreatexpress\u002Fcs2modrewrite |\n| RedWarden | Malleable-aware filtering C2 reverse proxy | https:\u002F\u002Fgithub.com\u002Fmgeeky\u002FRedWarden |\n| redi | Automated nginx + Let's Encrypt CS redirector | https:\u002F\u002Fgithub.com\u002Ftaherio\u002Fredi |\n| socat | Dumb-pipe TCP forwarder | http:\u002F\u002Fwww.dest-unreach.org\u002Fsocat\u002F |\n| Let's Encrypt \u002F certbot | Free TLS certificates | https:\u002F\u002Fcertbot.eff.org\u002F |\n| ired.team | Red-team infrastructure reference | https:\u002F\u002Fwww.ired.team\u002Foffensive-security\u002Fred-team-infrastructure |\n\n## Validation Criteria\n\n- [ ] Team server firewalled to accept only the redirector source IP on the C2 port.\n- [ ] Redirector deployed (dumb pipe and\u002For filtering reverse proxy).\n- [ ] Filter rules derived from the actual malleable C2 profile (URI + User-Agent + headers).\n- [ ] Non-matching requests return a `302` to a benign decoy site (verified with curl).\n- [ ] Matching beacon requests are proxied to the hidden team server (verified with curl).\n- [ ] Valid TLS certificate issued and auto-renewal confirmed.\n- [ ] OPSEC controls applied (UA\u002Fheader validation, geofencing, decoy diversion).\n- [ ] Domain categorization \u002F CDN fronting considered where applicable.\n- [ ] Infrastructure rotation and decommissioning plan documented.\n- [ ] All activity confined to the authorized engagement scope.\n","# Building C2 Redirector Infrastructure\n\n> **Authorized Use Only:** This skill is for authorized red-team engagements, adversary-emulation exercises, and defensive research only. Command-and-control infrastructure is dual-use; deploying redirectors to control malware on systems you are not explicitly authorized to test is illegal. Operate only inside an agreed scope with a signed rules-of-engagement document, and decommission infrastructure when the engagement ends.\n\n## Overview\n\nA C2 redirector is an intermediary host that sits between victim implants and the real team server. Beacons connect to the redirector's public domain\u002FIP; the redirector inspects each request and either proxies legitimate C2 traffic back to the hidden team server or diverts everything else (scanners, blue-team analysts, sandboxes) to a benign decoy site. This protects the team server from discovery, takedown, and attribution, and lets operators rotate the public edge without rebuilding the backend. The technique maps to MITRE ATT&CK **T1090.002 (Proxy: External Proxy)** — adversaries route C2 through an intermediary node to obscure the true origin.\n\nRedirectors come in two flavors. **Dumb pipes** (socat, iptables NAT) blindly forward a port and provide separation but no filtering. **Smart\u002Ffiltering redirectors** (nginx `proxy_pass`, Apache `mod_rewrite` with `[P]`, or purpose-built tools like RedWarden) parse HTTP requests and only forward traffic that matches the implant's Malleable C2 profile — correct URI, User-Agent, headers — while sending everything else a `302` to a real website. The filtering logic is derived directly from the C2 framework's traffic profile, so the two must stay in lock-step. Tools such as `cs2modrewrite` automate generating Apache\u002Fnginx rules from a Cobalt Strike Malleable C2 profile.\n\nThis skill covers building both dumb and filtering redirectors with nginx and Apache, deriving filter rules from a malleable profile, layering TLS with Let's Encrypt, and applying OPSEC controls (categorized domains, domain fronting\u002FCDN fronting, header validation, geo\u002FUA filtering) for resilient, low-attribution infrastructure.\n\n## When to Use\n\n- Standing up red-team C2 that must survive blue-team triage and domain takedown requests.\n- Separating a hidden team server from any internet-facing host during an engagement.\n- Filtering implant traffic so only profile-matching requests reach the backend, diverting scanners.\n- Adding TLS termination, domain categorization, and CDN\u002Fdomain fronting to an HTTP(S) listener.\n- Teaching defenders how external-proxy C2 (T1090.002) is constructed so they can detect it.\n\n## Prerequisites\n\n- One or more disposable cloud VPS instances (the redirector edge) and a separate, firewalled team-server host.\n- A registered domain with controllable DNS, ideally aged\u002Fcategorized.\n- Root on the redirector host. Install the web server and TLS tooling:\n  ```bash\n  # Debian\u002FUbuntu redirector\n  sudo apt update\n  sudo apt install -y nginx apache2 socat certbot python3-certbot-nginx git\n  # Enable Apache proxy modules if using mod_rewrite redirector\n  sudo a2enmod rewrite proxy proxy_http ssl headers\n  ```\n- The C2 framework's Malleable C2 profile (Cobalt Strike `.profile`, Sliver\u002FHavoc HTTP profile) defining URIs, User-Agent, and headers.\n- `cs2modrewrite` to auto-generate rules from a Cobalt Strike profile:\n  ```bash\n  git clone https:\u002F\u002Fgithub.com\u002Fthreatexpress\u002Fcs2modrewrite\n  ```\n- Firewall the team server so it only accepts the redirector's source IP on the C2 port.\n\n## Objectives\n\n- Deploy a dumb-pipe redirector (socat\u002Fiptables) for fast port separation.\n- Deploy a filtering nginx reverse-proxy redirector keyed to a malleable profile.\n- Deploy an Apache `mod_rewrite` redirector with `[P]` proxying and `302` decoy fallback.\n- Auto-generate redirector rules from a Cobalt Strike profile with `cs2modrewrite`.\n- Terminate TLS with Let's Encrypt and harden the public edge.\n- Apply OPSEC: header\u002FUA validation, geo filtering, decoy diversion, and infra rotation.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Official Name | Relevance |\n|--------------|---------------|-----------|\n| T1090.002 | Proxy: External Proxy | The redirector is an external intermediary that proxies C2 to hide the team server |\n| T1090.004 | Proxy: Domain Fronting | CDN fronting routes beacon traffic through a trusted high-reputation domain |\n| T1071.001 | Application Layer Protocol: Web Protocols | C2 is tunneled over HTTP\u002FHTTPS shaped by the malleable profile |\n| T1573.002 | Encrypted Channel: Asymmetric Cryptography | TLS termination at the redirector encrypts the beacon channel |\n| T1583.006 | Acquire Infrastructure: Web Services | Disposable VPS\u002FCDN edges are acquired for resilient C2 |\n\n## Workflow\n\n### 1. Lab and firewall the team server\nPlace the team server on a private host. Restrict its C2 port to the redirector's IP only.\n```bash\n# On the team server: only the redirector (203.0.113.10) may reach 443\u002Ftcp\nsudo ufw default deny incoming\nsudo ufw allow from 203.0.113.10 to any port 443 proto tcp\nsudo ufw allow OpenSSH\nsudo ufw enable\n```\n\n### 2. Dumb-pipe redirector (socat \u002F iptables)\nFor quick separation with no filtering, forward the C2 port to the team server.\n```bash\n# socat foreground forward of 443 -> team server\nsocat TCP4-LISTEN:443,fork,reuseaddr TCP4:10.0.0.2:443\n\n# Or iptables DNAT (persistent)\nsysctl -w net.ipv4.ip_forward=1\niptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination 10.0.0.2:443\niptables -t nat -A POSTROUTING -p tcp -d 10.0.0.2 --dport 443 -j MASQUERADE\n```\n\n### 3. Filtering nginx reverse-proxy redirector\nOnly proxy requests whose URI matches the malleable profile; send everything else a `302` to a decoy. Replace the location regex and User-Agent with values from your profile.\n```nginx\n# \u002Fetc\u002Fnginx\u002Fsites-available\u002Fredirector.conf\nserver {\n    listen 443 ssl;\n    server_name cdn.example.com;\n\n    ssl_certificate     \u002Fetc\u002Fletsencrypt\u002Flive\u002Fcdn.example.com\u002Ffullchain.pem;\n    ssl_certificate_key \u002Fetc\u002Fletsencrypt\u002Flive\u002Fcdn.example.com\u002Fprivkey.pem;\n\n    # Proxy ONLY profile-matching C2 URIs to the hidden team server\n    location ~ ^\u002F(api\u002Fv2\u002Fjobs|cm\u002F[a-z0-9]+|push) {\n        # Require the implant's exact User-Agent\n        if ($http_user_agent != \"Mozilla\u002F5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\u002F537.36\") {\n            return 302 https:\u002F\u002Fwww.legitimate-decoy.com\u002F;\n        }\n        proxy_pass https:\u002F\u002F10.0.0.2;\n        proxy_ssl_verify off;\n        proxy_set_header Host $host;\n        proxy_set_header X-Forwarded-For $remote_addr;\n    }\n\n    # Everything else -> benign decoy\n    location \u002F {\n        return 302 https:\u002F\u002Fwww.legitimate-decoy.com\u002F;\n    }\n}\n```\n```bash\nsudo ln -s \u002Fetc\u002Fnginx\u002Fsites-available\u002Fredirector.conf \u002Fetc\u002Fnginx\u002Fsites-enabled\u002F\nsudo nginx -t && sudo systemctl reload nginx\n```\n\n### 4. Apache mod_rewrite redirector\nApache's `[P]` flag proxies matching requests to the team server; non-matches get a `302` redirect. This is the format `cs2modrewrite` produces.\n```apache\n# \u002Fetc\u002Fapache2\u002Fsites-available\u002Fredirector.conf  (inside \u003CVirtualHost *:443>)\nRewriteEngine On\nSSLProxyEngine On\n# Require the implant User-Agent\nRewriteCond %{HTTP_USER_AGENT} \"Mozilla\u002F5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\u002F537.36\" [NC]\n# Match valid C2 URIs (GET\u002FPOST\u002Fstager) from the malleable profile\nRewriteCond %{REQUEST_URI} ^\u002F(api\u002Fv2\u002Fjobs|cm\u002F[a-z0-9]+|push)\u002F?$\n# Proxy to the hidden team server, preserving the URI\nRewriteRule ^.*$ https:\u002F\u002F10.0.0.2%{REQUEST_URI} [P,L]\n# Everything else -> decoy site\nRewriteRule ^.*$ https:\u002F\u002Fwww.legitimate-decoy.com\u002F [R=302,L]\n```\n```bash\nsudo a2ensite redirector && sudo apache2ctl configtest && sudo systemctl reload apache2\n```\n\n### 5. Generate rules from a malleable profile\nLet `cs2modrewrite` build the Apache or nginx rules directly from your Cobalt Strike profile so the filter exactly matches beacon traffic.\n```bash\ncd cs2modrewrite\n# Apache mod_rewrite rules\npython3 cs2modrewrite.py -i havex.profile -c https:\u002F\u002F10.0.0.2 \\\n  -r https:\u002F\u002Fwww.legitimate-decoy.com -o \u002Fetc\u002Fapache2\u002Fredirect.rules\n# nginx config\npython3 cs2nginx.py -i havex.profile -c https:\u002F\u002F10.0.0.2 \\\n  -r https:\u002F\u002Fwww.legitimate-decoy.com -H cdn.example.com > \u002Fetc\u002Fnginx\u002Fsites-available\u002Fc2.conf\n```\n\n### 6. Terminate TLS with Let's Encrypt\nIssue a valid certificate so beacon HTTPS does not throw TLS warnings and the edge looks legitimate.\n```bash\nsudo certbot --nginx -d cdn.example.com --agree-tos -m ops@example.com --redirect\n# Verify auto-renewal\nsudo certbot renew --dry-run\n```\n\n### 7. Apply OPSEC controls\nLayer defenses against blue-team analysis: validate headers, geofence to the target country, divert sandboxes, and rotate edges. Consider CDN\u002Fdomain fronting (T1090.004) where supported.\n```bash\n# Example: drop non-target geographies at the firewall with ipset\u002FGeoIP,\n# require a custom auth header in the profile, and rotate the redirector\n# domain\u002FIP on a schedule. Check the redirector only forwards matched traffic:\ncurl -k https:\u002F\u002Fcdn.example.com\u002F                       # expect 302 to decoy\ncurl -k -A \"Mozilla\u002F5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\u002F537.36\" \\\n  https:\u002F\u002Fcdn.example.com\u002Fapi\u002Fv2\u002Fjobs                  # expect proxied response\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Source |\n|------|---------|--------|\n| nginx | Filtering reverse-proxy redirector | https:\u002F\u002Fnginx.org\u002F |\n| Apache mod_rewrite | `[P]` proxy + `302` decoy redirector | https:\u002F\u002Fhttpd.apache.org\u002Fdocs\u002Fcurrent\u002Fmod\u002Fmod_rewrite.html |\n| cs2modrewrite | Generate Apache\u002Fnginx rules from CS profile | https:\u002F\u002Fgithub.com\u002Fthreatexpress\u002Fcs2modrewrite |\n| RedWarden | Malleable-aware filtering C2 reverse proxy | https:\u002F\u002Fgithub.com\u002Fmgeeky\u002FRedWarden |\n| redi | Automated nginx + Let's Encrypt CS redirector | https:\u002F\u002Fgithub.com\u002Ftaherio\u002Fredi |\n| socat | Dumb-pipe TCP forwarder | http:\u002F\u002Fwww.dest-unreach.org\u002Fsocat\u002F |\n| Let's Encrypt \u002F certbot | Free TLS certificates | https:\u002F\u002Fcertbot.eff.org\u002F |\n| ired.team | Red-team infrastructure reference | https:\u002F\u002Fwww.ired.team\u002Foffensive-security\u002Fred-team-infrastructure |\n\n## Validation Criteria\n\n- [ ] Team server firewalled to accept only the redirector source IP on the C2 port.\n- [ ] Redirector deployed (dumb pipe and\u002For filtering reverse proxy).\n- [ ] Filter rules derived from the actual malleable C2 profile (URI + User-Agent + headers).\n- [ ] Non-matching requests return a `302` to a benign decoy site (verified with curl).\n- [ ] Matching beacon requests are proxied to the hidden team server (verified with curl).\n- [ ] Valid TLS certificate issued and auto-renewal confirmed.\n- [ ] OPSEC controls applied (UA\u002Fheader validation, geofencing, decoy diversion).\n- [ ] Domain categorization \u002F CDN fronting considered where applicable.\n- [ ] Infrastructure rotation and decommissioning plan documented.\n- [ ] All activity confined to the authorized engagement scope.\n",{"name":5,"tags":46,"author":47,"domain":34,"license":15,"version":48,"nist_csf":49,"subdomain":51,"description":7,"mitre_attack":52},[35,32,31,27,30,33,29,28],"mahipal","1.0",[50],"DE.CM-01","red-teaming",[53],"T1090.002","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fbuilding-c2-redirector-infrastructure",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":65,"prompt":75,"zipAvailable":76},[66,69,72],{"tool":67,"command":68},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-c2-redirector-infrastructure",{"tool":70,"command":71},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-c2-redirector-infrastructure",{"tool":73,"command":74},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-c2-redirector-infrastructure","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-c2-redirector-infrastructure\u002FSKILL.md",true,[78,83,89,93],{"path":79,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":82},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-c2-redirector-infrastructure\u002FLICENSE",{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Fapi-reference.md","REFERENCE","参考文档",2195,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-c2-redirector-infrastructure\u002Freferences\u002Fapi-reference.md",{"path":90,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fstandards.md",1819,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-c2-redirector-infrastructure\u002Freferences\u002Fstandards.md",{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"scripts\u002Fagent.py","SCRIPT","脚本",4818,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-c2-redirector-infrastructure\u002Fscripts\u002Fagent.py",[100,127,151,178,204,231],{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":107,"publishedAt":41},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[106],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[108,109,110,111,112,34,113,114,115,116,117,118,119,120,121,122,123,124,125,126],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":134,"publishedAt":41},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[133],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[135,123,136,137,112,138,34,115,139,140,141,142,143,144,145,146,147,148,149,150],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":161,"publishedAt":41},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[157,160],{"categoryNo":158,"categoryName":159,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[145,162,163,164,165,34,25,166,139,167,168,169,170,171,172,173,174,175,176,177],"backup","recovery","validating backup integrity for recovery","testing","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":185,"publishedAt":41},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[184],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[186,187,188,34,189,190,191,192,193,194,195,196,197,198,199,200,142,201,202,203],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":211,"publishedAt":41},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[210],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[212,213,214,34,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":238,"publishedAt":41},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[237],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[112,239,34,240,241,242,243,244,245,246,247,173,248,174,249,250,251,252,253,254],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]