HACKING PROJECT · network · Advanced
Custom C2 Infrastructure Redirector
Design and deploy resilient, filtered C2 redirector infrastructure for authorized adversary emulation while documenting the defensive detection surface it creates.
During authorized red-team and adversary-emulation engagements, command-and-control (C2) infrastructure is trivially discovered and burned when it is directly exposed, and blue teams block naive callbacks by IP/domain reputation. Operators need resilient, evasive infrastructure that separates the true C2 server from the internet-facing edge to survive defensive scrutiny. Understanding redirector design is equally critical for defenders learning to detect and dismantle this tradecraft.
**What you'll build**
Build a layered C2 redirector architecture that fronts a team server (e.g., a lab C2 framework) with reverse-proxy redirectors that perform traffic validation, filtering (User-Agent/URI/JA3 allowlisting), domain fronting/CDN pass-through where lawful, and malleable profile shaping. Include automated deployment (IaC), operational security controls, and — for the purple-team dimension — the detection artifacts each layer generates so defenders can hunt them.
**Objective** — Design and deploy resilient, filtered C2 redirector infrastructure for authorized adversary emulation while documenting the defensive detection surface it creates.
**Expected outcome** — An IaC-deployable redirector stack (proxy configs, traffic-validation rules, malleable profile, deployment automation) plus a defender playbook mapping each evasion technique to detection and D3FEND countermeasures.
**Difficulty** — Expert — demands deep networking, proxy/TLS internals, operational security discipline, and mature legal/ethical scoping for offensive infrastructure.
**Primary category** — Penetration Testing / Adversary Emulation; Secondary = Red Team Infrastructure, Threat Hunting, Detection Engineering
**Security domains** — Primary = Red Team; Secondary = Purple Team, Threat Intelligence (adversary tradecraft), Blue Team (detection engineering), DevSecOps (IaC)
**Technical focus** — C2 infrastructure design, reverse-proxy redirectors, traffic filtering/validation, malleable C2 profiles, domain fronting, JA3/JA4 TLS fingerprinting, OPSEC, infrastructure-as-code, adversary emulation, detection engineering, egress traffic analysis
**Core technologies** — Languages: Python, Bash, Go; Frameworks/Libraries: Nginx/Apache mod_rewrite, HAProxy, socat; Security Tools: Cobalt Strike / Mythic / Sliver / Havoc (lab-licensed), Redirector tooling, Suricata/Zeek (for detection side); Cloud/Infra: Terraform, Ansible, Docker, cloud VMs, CDN services, Let's Encrypt; AI/Data: traffic-pattern analysis for detection modeling; Databases: PostgreSQL, logging backends
**Where it's valued** — Offensive security consultancies, red-team-as-a-service providers, defense/government, financial services (internal red teams), threat-intel and detection-engineering vendors
**Careers it builds toward** — Red Team Operator, Adversary Emulation Engineer, Offensive Security Consultant, Red Team Infrastructure Engineer, Detection Engineer (purple-team crossover), Threat Researcher
**Framework alignment**
• MITRE ATT&CK: Command and Control — Application Layer Protocol Web Protocols (T1071.001), Ingress Tool Transfer (T1105), Proxy (T1090) incl. External/Multi-hop Proxy (T1090.002/.003), Web Service (T1102), Encrypted Channel (T1573), Domain Fronting (T1090.004)
• NIST CSF 2.0: primarily supports Detect (Adverse Event Analysis) and Protect through adversary emulation informing defenses; Identify (control validation)
• OWASP: N/A (infrastructure/tradecraft project)
• CIS Controls v8: validates 13 (Network Monitoring & Defense), 9 (Email/Web Browser Protections egress), 18 (Penetration Testing); MITRE D3FEND network-traffic analysis for the defensive mapping
**Innovation** — Improved Existing Solution — redirector patterns are established tradecraft, but a fully IaC-automated, detection-annotated purple-team teaching stack is a valuable, differentiated deliverable. Scores: Innovation 6/10, Startup 4/10, Enterprise-Readiness 5/10, Patent = No.