github.comrepodstours/OctoC2
OctoC2 is a GitHub-native command-and-control framework built with TypeScript/Bun, featuring a beacon, durable controller, operator dashboard, and CLI. It supports multiple encrypted transports (GitHub Issues/branches/Actions/Gists/Git Notes, HTTPS/WebSocket, gRPC with mTLS, GitHub Actions OIDC, and relayed Codespaces SSH tunnels) with a signed task protocol, Ed25519 beacon identities, exclusive delivery leases, and replay-protected state for authorized red-team and security research engagements.
TL;DR A GitHub-backed multi-channel C2 framework (TypeScript/Bun) for authorized red-team testing with encrypted, signed transports and failover.
Technologies named here
- OctoC2
- HTTPS/WebSocket
- gRPC with mTLS
- GitHub Actions OIDC
- Signed two-repository proxy
- Relay consortium
- Codespaces SSH tunnel
- octoctl
- Bun 1.3.14
- Node.js 22.14.0
- GitHub CLI
- SQLite
- bun audit
- GitHub Actions
- Bun
- TypeScript
- grpc
Techniques named here
- GitHub-backed covert C2 channels
- Steganographic PNG transport
- Signed task protocol
- Exclusive delivery leases
- Replay protection / durable task ledger
- mTLS with per-beacon certificate fingerprint binding
Related in Offensive Security
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
github.comrepoYesWeHack Claude Kit
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
huntress.comwriteup