Cobalt Strike
-
Verified
This repository offers tools and examples designed to help you get more out of Cobalt Strike. Our goal is to support researchers in pushing the limits of what the product can do—building creative, high-impact tools and techniques.
We're continually inspired by the community, which proves every day that great ideas come from collaboration and innovation beyond what we could achieve alone.
Happy Hacking!
We believe that flexibility is key to effective evasion and threat emulation. Cobalt Strike gives users the power to adapt—whether by tweaking malleable C2 profiles or going deeper with full customizations using our Arsenal Kit and Public Templates and Examples.
Whether you're modifying configurations or building custom implementations, you have the freedom to shape every stage of the attack chain.
- Sleepmask-VS: A simple Sleepmask BOF example.
- BOF-VS: A Beacon Object File (BOF) template for Visual Studio.
- BOF Template: Core files needed to create a Beacon Object File for use with Cobalt Strike.
- Malleable C2 Profiles: This repository is a collection of Malleable C2 profiles that you may use.
- Cobalt Strike Reference Profile: Profile that is meant to show all of the options available in Malleable profiles.
- User Defined C2 (UDC2): BOF Template to allow third-party programs to act as a communication layer for Cobalt Strike’s Beacon payload. An example using ICMP is available here.
- External C2: Specification to allow third-party programs to act as a communication layer for Cobalt Strike’s Beacon payload.
- Aggressor Script Examples: Tips, tricks, and examples of aggressor script functions.
- Callback Examples: Examples demonstrating how to use callback functions in supported aggressor script functions.
- Cobalt Strike REST API Python Script Examples: Python Examples for interacting with the Cobalt Strike REST API. The examples are built on top of the Code generated by the OpenAPI Generator.
- Cobalt Strike Community Kit: The Cobalt Strike Community Kit is a curated repository of tools written by Cobalt Strike users and is another example of the level of community that sets Cobalt Strike apart from other C2 frameworks.
Pinned Loading
Repositories
- community_kit Public
Cobalt Strike is a post-exploitation framework designed to be extended and customized by the user community. Several excellent tools and scripts have been written and published, but they can be challenging to locate. Community Kit is a central repository of extensions written by the user community to extend the capabilities of Cobalt Strike. The…
- sleep2rest Public
Library that provides Aggressor Script functions for interacting with the Cobalt Strike REST API from the client
- cna-rest-core Public
- teamserver-prop Public
TeamServer.prop is an optional properties file used by the Cobalt Strike teamserver to customize the settings used to validate screenshot and keylog callback data, which allows you to tweak the fix for the “HotCobalt” vulnerability. This repository contains an example file that contains the default settings.
- Malleable-C2-Profiles Public Forked from rsmudge/Malleable-C2-Profiles
Malleable C2 is a domain specific language to redefine indicators in Beacon's communication. This repository is a collection of Malleable C2 profiles that you may use. These profiles work with Cobalt Strike 3.x.
- cobaltstrike-web-client Public
A PoC web interface for interacting with Cobalt Strike through its REST API.
- beacon-interpreter Public
People
This organization has no public members. You must be a member to see who’s a part of this organization.
Top languages
Loading…
Most used topics
Loading…