> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/c2-framworks/01-introduction-to-c2-command-and-control.md).

# 01 — Introduction to C2 (Command and Control)

### 1.1 What is C2?

Command and Control (C2) is the infrastructure and protocol an attacker — or, in authorized testing, a red teamer, uses to **maintain contact with, issue commands to, and receive data from** a compromised host after initial access. In the MITRE ATT\&CK framework, "Command and Control" is its own tactic (TA0011), because almost every real intrusion needs a reliable back-channel once the first foothold is gained.

Without C2, a single exploit gives you a one-shot foothold. With C2, you have an ongoing, controllable presence ,which is what real adversaries have, and what your client needs you to simulate to test their detection and response.

### 1.2 Why Red Teams Use C2

* Simulate real adversary behavior for detection/response testing (purple team exercises).
* Maintain access across a long engagement without re-exploiting the same vulnerability repeatedly.
* Centralize command, logging, and reporting across many compromised hosts.
* Test an organization's ability to detect beaconing, lateral movement, and data staging — not just the initial exploit.

### 1.3 The C2 Lifecycle

```
Recon → Initial Access → Execution → C2 Establishment → Post-Exploitation → Reporting / Cleanup
```

* **Recon** — identify targets, entry points, technology stack.
* **Initial Access** — phishing, an exploited service, physical access, etc.
* **Execution** — run the implant/stager on the victim host.
* **C2 Establishment** — the implant checks in to your listener; a session or beacon is created.
* **Post-Exploitation** — recon, privilege escalation, lateral movement, data collection — all directed through the C2 channel.
* **Reporting / Cleanup** — remove implants, close listeners, document everything for the client report.

### 1.4 Diagram — Where C2 Sits in an Engagement

```mermaid
flowchart LR
    A[Recon] --> B[Initial Access]
    B --> C[Execution]
    C --> D[C2 Established]
    D --> E[Post-Exploitation<br/>all via C2 channel]
    E --> F[Reporting / Cleanup]
```

### 1.5 What's Next

`02-c2-basics.md` breaks down the actual components — team server, listener, implant, operator console, redirector — that make up any C2 framework, Sliver included.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/c2-framworks/01-introduction-to-c2-command-and-control.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.