Web Protocols
Sub-technique of T1071 Application Layer Protocol ↗
Talking to a C2 implant over HTTP or HTTPS to blend in with normal traffic.
How it shows up on Hack The Box
On HTB you rarely need a C2, but in Pro Labs and red team certifications (CRTO) you do: Sliver, Havoc or Mythic with HTTPS listeners.
There are no catalog machines with this technique yet: practice it with the commands and guides in your own lab.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
C2 and post-exploitation › Sliver
Server and console
Attacker
sliver-serverC2 and post-exploitation › Havoc
Teamserver
Attacker
./havoc server --profile profiles/havoc.yaotl -v
Client
Attacker
./havoc clientC2 and post-exploitation › Mythic
Install and start
Attacker
sudo ./mythic-cli install github https://github.com/MythicAgents/apollo
sudo ./mythic-cli start
Show the panel password
Attacker
sudo ./mythic-cli config get MYTHIC_ADMIN_PASSWORDNo command matches.