Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
malleable-c2 — Cobalt Strike Malleable C2 Design and Reference Guide | Kitploit
Tools/GitHubGitHub/threatexpress/malleable-c2
Post-ExploitationPenetration TestingCommand and ControlLearning & EducationRed TeamingCurated ResourcesPayload Development
GitHubthreatexpress/malleable-c2

malleable-c2

Cobalt Strike Malleable C2 Design and Reference Guide

View Repository
1.8k29732 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Cobalt Strike Malleable C2 Design and Reference Guide

This project is intended to serve as reference when designing Cobalt Strike Malleable C2 profiles.

Always verify your profile with ./c2lint [/path/to/my.profile] prior to use!

Malleable C2 Profile Guidance

The following dive deeper into the understanding of Malleable C2

  • MalleableExplained.md : Quick profile reference guide
  • ThreatExpress - A Deep Dive into Cobalt Strike Malleable C2 : Orignal blog post the where the jquery reference profile was created
  • Understanding Cobalt Strike Profiles : Revised (current) blog on profile guidance
  • Random Profile Generator : Profile generator with more examples and options for settings

Changelog

20231017 - Updated for CS 4.9

  • Added 4.9 reference profile
  • Updated MalleableExplained.md with new 4.9 options
    • post-ex.cleanup
Download Tool
  • .http-beacon.library

    • 20230801 - Updated for CS 4.8

    • Added 4.8 reference profile
    • Updated MalleableExplained.md with new 4.8 options
      • stage.syscall_method

    20221022 - Updated for CS 4.7

    • Added 4.7 reference profile
    • Updated MalleableExplained.md with 4.7 considerations

    20220421 - Updated for CS 4.6

    • Added 4.6 reference profile
    • No more '1MB' limit
      • Add section "Task and Proxy Max Size" with new options
        • set tasks_max_size "1048576";
        • set tasks_proxy_max_size "921600";
        • set tasks_dns_proxy_max_size "71680";
      • Additional Considerations for the 'task_' Settings
    • Updated MalleableExplained.md with 4.6 considerations

    202112 - Updated for CS 4.5

    • Added 4.5 reference profile
    • Updated MalleableExplained.md with 4.5 considerations

    202108 - Added MalleableExplained.md

    • Reference from Andy Gill (@ZephrFish)
    • Reference blog: https://blog.zsec.uk/cobalt-strike-profiles/

    202103 - Add CS 4.3 Reference Profile

    • Add latest Malleable C2 profile options for Cobalt Strike 4.3
    • Moved dns settings to new dns-beacon section
    • 4.3 Additions
      • dns-beacon
        • beacon
        • get_A
        • get_AAAA
        • get_TXT
        • put_metadata
        • put_output
        • ns_response
      • http-config
        • block_useragents

    202011 - Add CS 4.2 Reference Profile

    • Add latest MalleablePE and MalleableC2 options for Cobalt Strike 4.1 and 4.2
    • 4.1 Additions: tcp_frame_header, smb_frame_header, ssh_banner
    • 4.2 Additions:
      • global
        • data_jitter
        • headers_remove
        • ssh_pipename
      • postex
        • pipename
        • thread_hint
        • keylogger
      • stage
        • allocator
        • magic_mz_86|magic_mz_64
        • magic_pe

    202003 - CS 4.0 Reference Profile

    • Add CS4.0 reference profile of available malleable C2 options
    • Remove deprecated features (amsi_disable, disable for process injection techniques, etc)

    Authors

    • @joevest
    • @001SPARTaN
    • @andrewchiles
    • @Charles-Foster-Kane

    License

    This project and all individual scripts are under the GNU GPL v3.0 license.