skills.rest
dbx0
dbx0COMMUNITY
Explore all skills by this author →
WebsiteGitHub

c2-panel-analysis

Analyzes exposed threat actor C2 panels to extract APIs, protocols, and infrastructure evidence.

7|4|Updated Jun 22, 2026
Search Tags:#incident response#threat intelligence#api enumeration#evidence preservation#c2 panel#websocket analysis#whois osint
One-click install
npx skills add https://github.com/dbx0/skills --skill c2-panel-analysis-dbx0
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: c2-panel-analysis
Source: https://github.com/dbx0/skills/tree/main/skills/malware-c2/command-and-control/c2-panel-analysis
Command: npx skills add https://github.com/dbx0/skills --skill c2-panel-analysis-dbx0

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? When incident responders discover an exposed threat actor command-and-control admin panel, they lack a structured playbook for rapidly classifying the panel, extracting its full API surface, mapping the C2 protocol, and preserving evidence before the infrastructure goes offline. ## Core Features & Use Cases - Panel Classification & Source Extraction: Identify panel types (RPX/DNS Manager, NSA-style surveillance suites, credential harvesters) in seconds via HTML titles, auth storage keys, and WebSocket presence, then pull exposed JavaScript source to enumerate every API endpoint. - Protocol & WebSocket Analysis: Map C2 command protocols, test WebSocket auth flows, enumerate agent-to-panel events (keylogging, cookie theft, screenshot capture), and probe for unauthenticated access. - Infrastructure Correlation & OSINT: WHOIS pivots (including .com.br registrant data), Telegram username checks, nameserver correlation, and stolen-identity detection to attribute panels to operators. - Use Case: During an IR engagement you find a suspicious dashboard on port 3000. Use this Skill to fingerprint the panel type, dump its JS source, enumerate authenticated API endpoints, test for auth bypass, and preserve hashed evidence with WHOIS and DNS records. ## Quick Start Analyze the exposed C2 panel at this URL: classify the panel type, enumerate its API endpoints from the JavaScript source, test for unauthenticated access, and preserve all evidence with hashes.

Frequently Asked Questions about c2-panel-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze an exposed C2 panel found during incident response?▼

Start by classifying the panel type via its HTML title, login URL pattern, and auth storage key. Then check for exposed JavaScript source at /app.js or /js/Dashboard.js to enumerate all API endpoints, map the C2 protocol, and test each endpoint for unauthenticated access.

How to test WebSocket C2 servers for authentication bypass?▼

Connect without sending an auth message and inspect whether the initial_state payload contains real client data. Then send malformed or empty tokens to check if agent events still leak. Python's websocket-client library can script this probe in a few lines.

Can WHOIS data identify threat actors behind C2 domains?▼

Yes, especially for ccTLDs without privacy services like .com.br and .cn, which mandate real registrant names, CPF/CNPJ identifiers, and contact emails. A mismatch between registrant name and email handle, combined with foreign hosting, signals stolen identity.

What evidence should be preserved from a C2 panel before it goes offline?▼

Save full page source, all JavaScript modules, API request/response pairs, server headers, WHOIS output with timestamps, and complete DNS records. Hash every downloaded file with SHA-256 and screenshot the UI for the evidence package.

What are the limitations of C2 panel source code analysis?▼

Client-side JavaScript only reveals the panel's frontend logic and API contracts, not server-side validation or backend source. Some panels serve SPA catch-all routes instead of real JS modules, and findings require manual verification since exposed source does not guarantee exploitable auth weaknesses.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

performing-network-traffic-analysis-with-zeek

Deploy Zeek to capture and analyze network traffic metadata for threat detection and forensics.

Community
Advanced
SherifEldeebSherifEldeeb
5

threat-intelligence

Extract, normalize, and report cyber threat intelligence from unstructured text.

Community
Intermediate
xalgordxalgord
954

analyzing-command-and-control-communication

Analyzes malware C2 protocols, beacon patterns, and infrastructure to build detection signatures.

Community
Advanced
xalgordxalgord
954

analyzing-network-traffic-of-malware

Analyzes malware PCAP traffic to identify C2 protocols, exfiltration channels, and beaconing patterns.

Community
Advanced