> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/c2-framworks/02-c2-basics-core-components.md).

# 02 — C2 Basics: Core Components

Every C2 framework Sliver, Cobalt Strike, Mythic, Havoc, whatever is built from the same handful of moving parts. Learn these once, and every framework you touch after this becomes "same concept, different UI."

### 2.1 Core Components

| Component                    | Role                                                                                             |
| ---------------------------- | ------------------------------------------------------------------------------------------------ |
| **Team Server**              | Central brain — hosts listeners, stores session state, brokers between operators and implants    |
| **Listener**                 | Network service (HTTP, DNS, TCP, mTLS, etc.) that accepts implant check-ins                      |
| **Implant / Agent / Beacon** | Code running on the compromised host that executes tasks and reports back                        |
| **Operator Console**         | Client application testers use to connect to the team server and control implants                |
| **Redirector**               | Optional front-facing proxy that hides the real team server IP from the target/network defenders |

### 2.2 Diagram — Basic C2 Architecture

```mermaid
flowchart LR
    Op["Operator Console"] <--> TS["Team Server"]
    TS <--> LStn["Listener (HTTP/DNS/mTLS/etc.)"]
    LStn <--> Imp1["Implant on Host A"]
    LStn <--> Imp2["Implant on Host B"]
    Imp2 -. P2P pivot .-> Imp3["Implant on Host C (no direct internet)"]
```

### 2.3 How the Pieces Interact

1. Operator connects to the **team server** through an authenticated console.
2. Operator starts a **listener** on the team server (e.g., an HTTPS listener on port 443).
3. Operator **generates an implant** configured to call back to that listener.
4. The implant runs on the victim host and checks in, this creates a **session** or **beacon**.
5. Operator issues tasks through the console; the team server routes them to the right implant via the listener.
6. Implants that can't reach the listener directly (deep in a segmented network) can **pivot** through another implant that can.

### 2.4 Communication Models (Quick Preview)

* **Interactive (session)**: near real-time, commands run immediately. Noisier.
* **Beaconing (asynchronous)**: implant checks in on an interval, then goes quiet. Stealthier.
* **Peer-to-peer (P2P)**: implants relay traffic to each other so only one host needs direct C2 connectivity.

### 2.5 What's Next

`03-c2-concepts-and-types.md` covers the actual protocols and traffic types used for the listener↔implant channel, and the beacon vs. session distinction in depth.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/c2-framworks/02-c2-basics-core-components.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.