▲CyberLearn
← Back to beginner
Beginner

Simple C2 Beacon

Command and Control beacon/server

Log in to track progress
⏱ 3–5hPythonReactDocker

What you'll learn

  • C2 architecture
  • MITRE ATT&CK
  • WebSocket protocol
  • XOR encoding
View source on GitHub ↗
 ██████╗██████╗     ██████╗ ███████╗ █████╗  ██████╗ ██████╗ ███╗   ██╗
██╔════╝╚════██╗    ██╔══██╗██╔════╝██╔══██╗██╔════╝██╔═══██╗████╗  ██║
██║      █████╔╝    ██████╔╝█████╗  ███████║██║     ██║   ██║██╔██╗ ██║
██║     ██╔═══╝     ██╔══██╗██╔══╝  ██╔══██║██║     ██║   ██║██║╚██╗██║
╚██████╗███████╗    ██████╔╝███████╗██║  ██║╚██████╗╚██████╔╝██║ ╚████║
 ╚═════╝╚══════╝    ╚═════╝ ╚══════╝╚═╝  ╚═╝ ╚═════╝ ╚═════╝ ╚═╝  ╚═══╝

Cybersecurity Projects Python React License: AGPLv3 Docker MITRE ATT&CK

Command and Control beacon and server with XOR-encoded WebSocket protocol, 10 MITRE ATT&CK mapped commands, and a real-time operator dashboard.

This is a quick overview — security theory, architecture, and full walkthroughs are in the learn modules.

What It Does

  • WebSocket-based C2 protocol with XOR + Base64 encoding and shared-key authentication
  • 10 beacon commands mapped to MITRE ATT&CK: shell, sysinfo, proclist, upload, download, screenshot, keylog, persist, sleep
  • Real-time operator dashboard showing connected beacons with live heartbeat tracking
  • Terminal-style session page with command history, tab autocomplete, and inline screenshot rendering
  • Per-beacon async task queues with SQLite persistence and full task history
  • Exponential backoff reconnection with configurable sleep interval and jitter

Quick Start

docker compose -f dev.compose.yml up -d

Visit http://localhost:47430 to open the operator dashboard.

Run a beacon in a separate terminal:

just beacon

[!TIP] This project uses just as a command runner. Type just to see all available commands.

Install: curl -sSf https://just.systems/install.sh | bash -s -- --to ~/.local/bin

Stack

Backend: FastAPI, aiosqlite, Pydantic, uvicorn

Frontend: React 19, TypeScript, Vite, Zustand, Zod

Beacon: asyncio, websockets, psutil, pynput, mss

Learn

This project includes step-by-step learning materials covering security theory, architecture, and implementation.

ModuleTopic
00 - OverviewPrerequisites and quick start
01 - ConceptsC2 frameworks, MITRE ATT&CK, and detection
02 - ArchitectureProtocol design and data flow
03 - ImplementationCode walkthrough
04 - ChallengesExtension ideas and exercises

License

AGPL 3.0

<img width="1827" height="853" alt="Screenshot_20260214_022250" src="https://github.com/user-attachments/assets/9f26428f-53cc-49be-84cc-346357e8ef00" /> <img width="1103" height="828" alt="Screenshot_20260214_022135" src="https://github.com/user-attachments/assets/27876356-ec9d-4a0f-af71-92c3c7714232" />