C2 REDIRECTORS MADE EASY

Summary from the TLDR InfoSec newsletter

Red teamers traditionally must manually configure C2 redirector proxy rules by reviewing profiles and adding User-Agent strings and HTTP endpoints to configuration files, requiring updates whenever the C2 profile changes. The author developed caddy-c2, a Caddy web server module that automatically parses Cobalt Strike profiles using goMalleable to extract User-Agents and URI paths, then dynamically routes legitimate C2 traffic without manual rule configuration. The module simplifies redirector deployment by eliminating the need to manually sync proxy configurations with C2 profile changes, though current support is limited to Cobalt Strike, with plans to expand to frameworks such as Mythic and Havoc.