> For the complete documentation index, see [llms.txt](https://blog.r00t-hunter.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.r00t-hunter.com/c2-infrastructure.md). # C2 Infrastructure *** > "A red teamer who doesn't understand their own C2 is just running someone else's tool. A defender who doesn't understand C2 is defending against a ghost." ### Overview This section documents how command-and-control (C2) frameworks work, how to deploy them in an isolated lab environment, and what each one reveals about attacker tradecraft and defensive detection opportunities. Each article covers a specific framework in depth - its architecture, deployment process, operational use, and the artifacts it leaves behind that a blue team could realistically catch. These guides are written for an isolated lab (Kali Linux, no internet-facing infrastructure) as part of ongoing red team and detection engineering study. Only run C2 tooling against systems and networks you own or are explicitly authorized to test - deploying it against third-party systems without permission is illegal in most jurisdictions. Each framework writeup follows a consistent structure: * **What Is a C2 Server, Really** - the conceptual model behind client-server-listener architecture and why it matters, framed for whichever framework the article covers * **Meet the Framework** - origin, architecture, what makes it distinct from other C2s on the market (open-source vs commercial, language, protocol support, malleability) * **Lab Prerequisites** - hardware/VM specs, network isolation requirements, dependencies * **Step-by-Step Installation** - the full deployment walkthrough, teamserver and client setup, first listener and payload generation * **Operational Notes** - things that only become obvious once you're actually running it (cert handling, opsec considerations, common pitfalls) * **Where to Go From Here** - next steps, related reading, and how it ties into the broader lab/detection work The goal of this collection is to understand C2 frameworks from both sides of the fence - building enough operator fluency to understand real intrusion tradecraft, while documenting the defensive signal each framework generates along the way. Not a tool review, not a "best C2" ranking - just a working reference for how these things actually get stood up and used. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://blog.r00t-hunter.com/c2-infrastructure.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.