C2 Redirector Infrastructure Builder
Builds traffic-filtering C2 redirector servers that forward only implant-matching traffic to a hidden team server.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 4 files
What it does
This skill teaches an AI agent how to set up the internet-facing relay servers used in red-team exercises, called C2 redirectors, which sit between simulated malware (implants) and a hidden team server. Once installed, the agent can write nginx and Apache configuration, socat or iptables forwarding rules, and generated filter rules that pass only traffic matching a Malleable C2 profile while sending everything else to a decoy website. It also covers Let's Encrypt TLS setup and OPSEC tactics such as domain fronting and User-Agent filtering, and it includes a Python script that generates an nginx config from URI patterns and a User-Agent.
Great for
- Red-team operators building authorized adversary-emulation infrastructure
- Blue-team defenders learning how external-proxy C2 (T1090.002) is constructed so they can detect it
- Students studying offensive infrastructure design in a supervised lab
Skip it if
- Anyone without written authorization and an agreed scope: deploying redirectors to control systems you are not permitted to test is illegal and harmful
- General web server or reverse-proxy work, since the skill is oriented toward evading defenders rather than standard hosting
Try asking
- “Write an nginx filtering redirector config that proxies only URIs matching my Malleable C2 profile to my team server at 10.0.0.2”
- “Generate Apache mod_rewrite rules with a 302 decoy fallback for a Cobalt Strike profile”
- “Set up a socat dumb-pipe forward from port 443 to my team server and firewall the team server to accept only the redirector IP”
- “Use the generator script to create an nginx config from a list of URIs and an implant User-Agent”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.
building-c2-redirector-infrastructure.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip building-c2-redirector-infrastructure.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip building-c2-redirector-infrastructure.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Provide the exact Malleable C2 profile URIs and User-Agent so generated filters match the implant; mismatched rules break beacons.
- Keep the team server firewalled to the redirector IP and review the generated configs before deploying them.
- Only use this in an authorized engagement with signed rules of engagement, and decommission the infrastructure afterward.
What's inside
- references/api-reference.md
- references/standards.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.