Protocol-Hopping C2: Transport-Agnostic Command & Control That Won't Die
summary
A tiny Python-based C2 lab implements a stateful core with pluggable adapters that successfully fails over live from HTTP headers to DNS TXT records and then ICMP, proving the ICMP DNS HTTP headers combo can carry the same session without changing logic. The demo shows the session ID persists, intent and scheduler survive transport disruption, and blocking a protocol degrades connectivity but does not eradicate control — require endpoint validation and layered behavior+network detection.
AI-written summary · about
chapters (11)
- 0:00Protocol-hopping C2 intro
- 1:07Command and control architecture
- 3:30Transport disruption fails
- 6:42Command logic vs transport adapters
- 8:26Protocol failover examples
- 9:48Transport failover demo
- 13:26Defensive implications
- 15:14Eradication validation checklist
- 16:42Protocol hopping trade-offs
- 17:25Key takeaways
- 18:10Q&A
related talks
29mProtocol-Hopping C2: Transport-Agnostic Command & Control That Won't Die
33mCAP_NET_RAW And ARP Spoofing in Your Cluster: It's Going Downhill From Here
26mMisuse of DNS, the Second Most Used Protocol
11mDetecting and Evading Censorship-in-Depth: A Case Study of Iran’s Protocol Whitelister
47mMultipath TCP: Breaking Today's Networks with Tomorrow's Protocols
44mFlying a False Flag: Advanced C2, Trust Conflicts, and Domain Takeover
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
35mTransparent Chaos Testing with Envoy , Cilium and BPF