Guide · Agent skill
How to use the C2 Redirector Infrastructure Builder agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The building-c2-redirector-infrastructure skill teaches an AI agent to design and write the configuration for C2 redirectors, the internet-facing relay servers used in authorized red-team exercises. It sits between simulated implants and a hidden team server. After reading this guide you will know how to install the skill, how to phrase requests so the agent uses it, and what you need in place before any of its output touches a real host.
C2 Redirector Infrastructure Buildermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or the project's .claude/skills/ folder for one project.
- 2Start a new session. Open a new Claude session so the agent loads the building-c2-redirector-infrastructure skill. Alternatively, upload the ZIP under Settings, Capabilities, Skills.
- 3Confirm authorization and scope. Make sure you have written authorization and an agreed scope before any deployment. The skill requires this for all work.
- 4Prepare hosts and tools. Set up a Linux VPS with root access and a firewalled team server, and install nginx, Apache2 modules, socat, certbot and git. Have your Malleable C2 profile ready.
- 5Ask for a specific build. Describe the redirector you need, such as a dumb pipe, nginx filtering proxy or Apache mod_rewrite setup, and include your profile URIs and User-Agent.
- 6Review before running. Read every generated config and script, including scripts/agent.py, and check the placeholder values have been replaced. Then validate with nginx -t before reloading.
What an agent skill is and what this one makes the agent do
An agent skill is a folder containing instructions (a SKILL.md file), reference notes and optional scripts that an AI agent loads when a task matches the skill's description. This skill covers redirector work: a dumb-pipe redirector that forwards a port without inspecting it, and a filtering redirector that only passes traffic matching a Malleable C2 profile and sends everything else to a decoy website.
Once installed, the agent can write nginx and Apache configuration, socat or iptables forwarding rules, and generated filter rules derived from a profile. It also covers Let's Encrypt TLS setup and OPSEC controls such as domain fronting and User-Agent filtering. The skill includes a Python script, scripts/agent.py, that generates an nginx config from URI patterns and a User-Agent.
Install the skill in Claude
Download the ZIP file from this page. For a personal setup, unzip it into ~/.claude/skills/ so the building-c2-redirector-infrastructure folder sits there. For a single project, unzip it into the project's .claude/skills/ folder instead. In the Claude apps you can also upload the ZIP under Settings, then Capabilities, then Skills.
After installing, start a new session so the agent sees the skill. The skill folder should contain SKILL.md, scripts/agent.py and the references folder. If the agent does not seem to use the skill, check that the folder name and location match the steps above.
- Personal: ~/.claude/skills/
- Project: .claude/skills/ inside the project folder
- Claude apps: Settings, Capabilities, Skills, then upload the ZIP
Trigger the skill with natural requests
The agent loads the skill when your request matches its description. The description covers building C2 redirectors with nginx proxy_pass and Apache mod_rewrite, deriving filter rules from a Malleable C2 profile, adding Let's Encrypt TLS, and using domain fronting or UA/geo filtering. Name those concepts directly in your request, and say that the work is for an authorized engagement.
Include the details the agent needs: your profile's URIs and User-Agent, the team server's address on your private network, and the public domain the redirector will use. The skill's examples use placeholder values such as 10.0.0.2 for the team server and cdn.example.com for the edge domain, so replace them with your own values.
- Example: Using the redirector skill, write an nginx filtering config for my Malleable C2 profile URIs and User-Agent, forwarding to team server 10.0.0.2 and sending other traffic to a decoy.
- Example: Using the redirector skill, give me socat and iptables commands to forward 443 to my team server for a dumb-pipe separation test.
- Example: Using the redirector skill, generate Apache mod_rewrite rules with the [P] flag and a 302 fallback from my profile.
- Example: Using the redirector skill, explain how to firewall the team server so only the redirector IP can reach the C2 port.
Prepare the requirements before running anything
The skill expects Linux VPS hosts with root access, nginx, Apache2 with the mod_rewrite and proxy modules, socat, certbot, git, a registered domain with DNS control, and a Cobalt Strike or other Malleable C2 profile. cs2modrewrite is optional but helps generate rules from a Cobalt Strike profile. Python 3 is needed to run scripts/agent.py.
The skill's prerequisites include installing the web server and TLS tooling on a Debian or Ubuntu redirector. Run these only on hosts you control and are authorized to use.
- Linux VPS with root access for the redirector
- A separate, firewalled team server host
- A registered domain with DNS control
- A Malleable C2 profile (Cobalt Strike .profile, or Sliver/Havoc HTTP profile)
- Python 3 for scripts/agent.py
sudo apt update && sudo apt install -y nginx apache2 socat certbot python3-certbot-nginx gitSafety notes: authorization, scripts and network use
The skill states that it is for authorized red-team engagements, adversary-emulation exercises and defensive research only. Command-and-control infrastructure is dual-use, and deploying redirectors to control malware on systems you are not explicitly authorized to test is illegal. Work only inside an agreed scope with a signed rules-of-engagement document, and decommission the infrastructure when the engagement ends.
This skill runs scripts and uses the network. Review scripts/agent.py and any commands the agent proposes before running them, especially on a live VPS. The skill is oriented toward evading defenders, so it is not intended for general web hosting or standard reverse-proxy work.
- Get written authorization and an agreed scope before deploying anything
- Review generated configs and scripts before running them
- Restrict the team server so only the redirector IP can reach its C2 port
- Tear down redirectors and domains when the engagement ends
Tips for getting useful output
Give the agent your real profile, not a summary. The filter rules must match the implant's URIs, User-Agent and headers exactly, and the skill notes that the redirector logic and the C2 profile must stay in lock-step. After the agent writes a config, ask it to test the nginx syntax before reloading, since the skill's workflow uses nginx -t before a reload.
Defenders can use the same material. The skill's ATT&CK mapping, including T1090.002 (Proxy: External Proxy), makes it useful for learning how external-proxy C2 is built so you can detect it.
- Paste the exact URI patterns and User-Agent from your profile
- Ask the agent to validate configs with nginx -t before reload
- Ask for both the filtering config and the decoy fallback
- Ask for the team server firewall rules alongside the redirector config
What people use it for
- Generating an nginx filtering config that proxies only profile-matching URIs to a team server and redirects other requests to a decoy site during an authorized adversary-emulation exercise.
- Creating an Apache mod_rewrite redirector with the [P] flag and a 302 fallback, using rules in the format cs2modrewrite produces.
- Writing socat or iptables DNAT commands to separate a public port from a team server in a supervised lab.
- Drafting firewall rules so a team server accepts C2 traffic only from the redirector's IP address.
- Helping blue-team defenders understand how external-proxy C2 (T1090.002) is built so they can write detections.
Frequently asked questions
How do I install the building-c2-redirector-infrastructure skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps you can instead upload the ZIP under Settings, then Capabilities, then Skills. Start a new session afterwards.
Is the building-c2-redirector-infrastructure skill free?
The skill is licensed under Apache-2.0, as stated on this page. Check the license file included with the download for the full terms before reusing or redistributing it.
What do I need to use this skill?
You need a Linux VPS with root access, nginx, Apache2 with mod_rewrite and proxy modules, socat, certbot, git, a registered domain with DNS control, and a Cobalt Strike or other Malleable C2 profile. cs2modrewrite is optional, and Python 3 is needed for scripts/agent.py.
Is it legal to use a C2 redirector?
Only inside authorized work. The skill is for authorized red-team engagements, adversary-emulation exercises and defensive research. Deploying redirectors to control malware on systems you are not explicitly authorized to test is illegal.
What is the difference between a dumb pipe and a filtering redirector?
A dumb pipe, such as socat or iptables NAT, forwards a port without inspecting traffic and provides separation only. A filtering redirector, such as nginx proxy_pass or Apache mod_rewise with [P], forwards only requests matching the malleable profile and sends everything else a 302 redirect to a real website.
What are alternatives to this skill for building redirectors?
The skill's source mentions purpose-built tools such as RedWarden and cs2modrewrite for generating rules from a Cobalt Strike profile. You can also write the configs manually with nginx or Apache, as the skill's examples show. The skill itself is not a general web server or reverse-proxy guide.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits authorized red-team operators, blue-team defenders studying external-proxy C2, and students working in a supervised lab who need concrete nginx, Apache and socat redirector configs. It is a poor fit for anyone without written authorization and an agreed scope, and for general web hosting or standard reverse-proxy work, which the skill does not target.
Download the skill