[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-653159-105":3,"detail-sidebar-cat-0-en-105":81,"doc-detail-653159-en":130},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","cobalt-strike-45-user-guide","Cobalt Strike 4.5 - User Guide","","Cobalt Strike 4.5 user guidance covering how to plan adversary simulations and red team operations from reconnaissance through weaponization and post-exploitation. It explains setting up a team server and starting client components, distributed and team operations, scripting support, and the client user interface including sessions, targets, and data management. It further details listener and infrastructure management, payload staging and covert C2 mechanisms, payload security and initial access, and post-exploitation operations like credential harvesting and pivoting.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/document/","Document",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/document/technology/","Technology",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/document/cobalt-strike-45-user-guide/653159/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/cobalt-strike-45-user-guide/653159.png","ImageObject",300,407,{"name":42,"@type":43},"RizkyPratama_92","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-30","2026-10-24",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",5,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What problem does Cobalt Strike’s offense workflow address?","Question",{"text":63,"@type":64},"It describes a targeted attack process where reconnaissance identifies the most likely successful options on the target, then weaponization pairs a post-exploitation payload with an appropriate document or exploit to execute it.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"How do you start and use Cobalt Strike components?",{"text":68,"@type":64},"The guide covers starting a team server and starting a Cobalt Strike client, then using client features such as sessions, target visualizations, consoles, and tables to manage operations and data.",{"name":70,"@type":61,"acceptedAnswer":71},"What topics are covered around infrastructure, payloads, and C2?",{"text":72,"@type":64},"It includes listener and infrastructure management, payload staging, beacon transport options, payload security features, and malleable command and control settings such as profile language and staging/server configuration.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},653159,1793014920,{"code":4,"msg":82,"data":83},"success",[84,88,92,96,100,104,109,114,119,122,126],{"id":22,"doc_module":4,"doc_module_name":25,"category_name":85,"show_sort_weight":86,"slug":87},"Story & Novel",90,"story-novel",{"id":26,"doc_module":4,"doc_module_name":25,"category_name":89,"show_sort_weight":90,"slug":91},"Literature",80,"literature",{"id":33,"doc_module":4,"doc_module_name":25,"category_name":93,"show_sort_weight":94,"slug":95},"Exam",70,"exam",{"id":55,"doc_module":4,"doc_module_name":25,"category_name":97,"show_sort_weight":98,"slug":99},"Comic",60,"comic",{"id":101,"doc_module":4,"doc_module_name":25,"category_name":29,"show_sort_weight":102,"slug":103},6,50,"technology",{"id":105,"doc_module":4,"doc_module_name":25,"category_name":106,"show_sort_weight":107,"slug":108},7,"Healthcare",40,"healthcare",{"id":110,"doc_module":4,"doc_module_name":25,"category_name":111,"show_sort_weight":112,"slug":113},8,"Research & Report",30,"research-report",{"id":115,"doc_module":4,"doc_module_name":25,"category_name":116,"show_sort_weight":117,"slug":118},9,"Religion & Spirituality",20,"religion-spirituality",{"id":117,"doc_module":4,"doc_module_name":25,"category_name":120,"show_sort_weight":117,"slug":121},"World Cup","world-cup",{"id":123,"doc_module":4,"doc_module_name":25,"category_name":124,"show_sort_weight":123,"slug":125},10,"Lifestyle","lifestyle",{"id":127,"doc_module":4,"doc_module_name":25,"category_name":128,"show_sort_weight":55,"slug":129},19,"General","general",{"code":4,"msg":82,"data":131},{"doc_id":79,"user_id":132,"nickname":42,"user_avatar":133,"doc_module":4,"category_id":101,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":139,"language":140,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":12,"update_tm":144,"read_time":145},962094243231,"https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d","User Guide  \nCobalt Strike 4.5  \nCopyright Help/Systems LLC and its group of companies.  \nThe content in this document is protected by the Copyright Laws of the United States of America and other countries worldwide. The unauthorized use and/or duplication of this material without express and written permission from HelpSystems is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to HelpSystems with appropriate and specific direction to the original content. HelpSystems and its trademarks are properties of the HelpSystems group of companies. All other marks are property of their respective owners.  \n202201250359  \nTable of Contents  \nWelcome to Cobalt Strike  8  \nOverview  8  \nInstallation and Updates  9  \nStarting the Team Server  16  \nStarting a Cobalt Strike Client  16  \nDistributed and Team Operations  18  \nScripting Cobalt Strike  20  \nRunning the Client on MacOS X  21  \nUser Interface  22  \nOverview  22  \nToolbar  23  \nSession and Target Visualizations  24  \nTabs  26  \nConsoles  27  \nTables  28  \nData Management  28  \nOverview  28  \nTargets  29  \nServices  29  \nCredentials  30  \nMaintenance  30  \nListener and Infrastructure Management  31  \nOverview  31  \nListener Management  31  \nCobalt Strike’s Beacon Payload  33  \nPayload Staging  33  \nDNS Beacon  33  \n[HTTP Beacon](HTTP Beacon) and [HTTPS Beacon](HTTPS Beacon)  37  \nSMB Beacon  41  \nUser Guide [www.helpsystems.com](www.helpsystems.com) page: 3  \nTCP Beacon  43  \nExternal C2  45  \nForeign Listeners  46  \nInfrastructure Consolidation  47  \nPayload Security Features  48  \nInitial Access  49  \nClient-side System Profiler  49  \nApplication Browser  49  \nCobalt Strike Web Services  50  \nUser-driven Attack Packages  50  \nHosting Files  54  \nUser-driven Web Drive-by Attacks  55  \nClient-side Exploits  58  \nClone a Site  59  \nSpear Phishing  59  \nPayload Artifacts and Anti-virus Evasion  62  \nThe Artifact Kit  63  \nThe Veil Evasion Framework  64  \nJava Applet Attacks  65  \nThe Resource Kit  65  \nThe Sleep Mask Kit  66  \nPost Exploitation  66  \nBeacon Covert C2 Payload  66  \nThe Beacon Console  66  \nThe Beacon Menu  67  \nAsynchronous and Interactive Operations  68  \nRunning Commands  68  \nSession Passing  69  \nAlternate Parent Processes  70  \nSpoof Process Arguments  70  \nBlocking DLLs in Child Processes  71  \nUpload and Download Files  71  \npage: 4 [www.helpsystems.com](www.helpsystems.com) User Guide  \nFile Browser  71  \nThe Windows Registry  72  \nKeystrokes and Screenshots  73  \nControlling Beacon Jobs  73  \nThe Process Browser  73  \nDesktop Control  74  \nPrivilege Escalation  76  \nMimikatz  78  \nCredential and Hash Harvesting  79  \nPort Scanning  79  \nNetwork and Host Enumeration  80  \nTrust Relationships  81  \nLateral Movement  82  \nLateral Movement GUI  82  \nOther Commands  83  \nBrowser Pivoting  84  \nOverview  84  \nSetup  85  \nUse  86  \nHow Browser Pivoting Works  87  \nPivoting  87  \nWhat is Pivoting  87  \nSOCKS Proxy  87  \nReverse Port Forward  88  \nSpawn and Tunnel  89  \nPivot Listeners  90  \nCovert VPN  91  \nSSH Sessions  92  \nThe SSH Client  92  \nRunning Commands  93  \nUpload and Download Files  93  \nPeer-to-peer C2  94  \nUser Guide [www.helpsystems.com](www.helpsystems.com) page: 5  \nSOCKS Pivoting and Reverse Port Forwards  94  \nMalleable Command and Control  95  \nOverview  95  \nChecking for Errors  95  \nProfile Language  96  \n[HTTP Staging](HTTP Staging)  101  \nA Beacon [HTTP Transaction Walk-through](HTTP Transaction Walk-through)  102  \n[HTTP Server Configuration](HTTP Server Configuration)  103  \nSelf-signed SSL Certificates with SSL Beacon  104  \nValid SSL Certificates with SSL Beacon  105  \nProfile Variants  106  \nCode Signing Certificate  106  \nDNS Beacons  107  \nExercising Caution with Malleable C2  108  \nMalleable PE, Process Injection, and Post Exploitation  109  \nOverview  109  \nPE and Memory Indicators  109  \nProcess Injection  113  \nControlling Process Injection  115  \nControlling Post Exploitation  118 ","cbCailrGRLvENwIw","https://ap.wps.com/l/cbCailrGRLvENwIw","pdf",7929911,354,"English","# Welcome to Cobalt Strike\n## Overview\n## The Offense Problem Set\n# Installation and Updates\n# Starting the Team Server\n# Starting a Cobalt Strike Client\n# Distributed and Team Operations\n# Scripting Cobalt Strike\n# User Interface\n## Toolbar\n## Session and Target Visualizations\n## Tabs\n## Consoles\n## Tables\n# Data Management\n## Targets\n## Services\n## Credentials\n# Listener and Infrastructure Management\n## Listener Management\n## Payload Staging\n## Payload Security Features\n# Initial Access\n## Client-side System Profiler\n## Application Browser\n# Post Exploitation\n## Beacon Covert C2 Payload\n## Upload and Download Files\n## Desktop Control\n# Command Execution and Pivoting\n## Running Commands\n## Browser Pivoting\n## SOCKS Proxy\n## Reverse Port Forward\n# Malleable Command and Control\n## Profile Language\n# Appendices and Additional Topics\n## Keyboard Shortcuts\n## Unicode Support","[{\"question\":\"What problem does Cobalt Strike’s offense workflow address?\",\"answer\":\"It describes a targeted attack process where reconnaissance identifies the most likely successful options on the target, then weaponization pairs a post-exploitation payload with an appropriate document or exploit to execute it.\"},{\"question\":\"How do you start and use Cobalt Strike components?\",\"answer\":\"The guide covers starting a team server and starting a Cobalt Strike client, then using client features such as sessions, target visualizations, consoles, and tables to manage operations and data.\"},{\"question\":\"What topics are covered around infrastructure, payloads, and C2?\",\"answer\":\"It includes listener and infrastructure management, payload staging, beacon transport options, payload security features, and malleable command and control settings such as profile language and staging/server configuration.\"}]","Cobalt Strike 4.5 - User Guide | PDF",1792886041,892]