5 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
This article explains how to use a Caddy module called caddy-c2 to automate the proxying of C2 traffic based on a Cobalt Strike profile. It eliminates the need for manual updates to proxy rules whenever the C2 profile changes, streamlining the setup process for red teaming activities.
If you do, here's more
C2 servers are essential in penetration testing and red teaming, acting as the control center for simulated attacks. Using a proxy server, or redirector, offers benefits like hiding the C2 server's location and ensuring only authorized traffic reaches it. However, configuring the proxy rules to allow legitimate C2 traffic can be tedious, especially when updates to the C2 profile require manual adjustments to the proxy configuration.
To streamline this process, the author developed a Caddy module named caddy-c2. Caddy is a modern, open-source web server that simplifies secure connections and offers a human-readable configuration. The caddy-c2 module automatically parses the C2 profile, extracting details such as User-Agent and URI paths. This automation reduces the need for constant manual updates in the configuration file when the C2 profile changes.
Installation of the caddy-c2 module involves using Go and the xcaddy tool to build Caddy with the new plugin. The configuration becomes much simpler, focusing on the c2_profile directive, which specifies the profile file and framework (currently limited to Cobalt Strike). This adjustment allows the server to handle matching traffic without manual updates for each change in the C2 profile.
Testing the setup with curl commands confirmed that the module correctly redirects traffic based on the specified User-Agent and URIs. The output showed the expected behavior for valid and invalid requests, validating the module's functionality in directing traffic to the C2 server.
Questions about this article
No questions yet.