[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-653162-105":59,"doc-detail-653162-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","cobalt-strike-basics","Cobalt Strike Basics","","Cobalt Strike Basics introduces Cobalt Strike as a command-and-control framework used for threat-based security testing, outlining its fit for Red Team, Purple Team, and pen tests. The content explains the product’s operating model and emphasizes operator skill. It then covers setup and architecture, including the Team Server, its Java-based nature and default console port, the Beacon agent on compromised hosts, beacon communications via multiple built-in and third-party listener options (HTTP/HTTPS/DNS, cloud and collaboration platforms), and RedirecTor’s role in proxying and hiding the team server with forwarding and plugin methods.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":30,"@type":76,"position":81},"https://docshare.wps.com/document/technology/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/cobalt-strike-basics/653162/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/cobalt-strike-basics/653162.png","ImageObject",300,407,{"name":92,"@type":93},"Dewi_Sukmawati","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-30","2026-10-24",true,{"@type":102,"interactionType":103,"userInteractionCount":29},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"What is Cobalt Strike used for?","Question",{"text":112,"@type":113},"Cobalt Strike is a command and control framework for threat-based security tests, supporting Red Team, Purple Team, and pen tests.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"What components make up Cobalt Strike setup?",{"text":117,"@type":113},"It includes a Team Server for listeners and beacon control, and Beacons running on compromised hosts that communicate back to the server.",{"name":119,"@type":110,"acceptedAnswer":120},"How do beacons communicate with the Team Server?",{"text":121,"@type":113},"Beacons use built-in listeners such as HTTP, HTTPS, and DNS, with additional extensions available for other C2 approaches like cloud and messaging platforms.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},653162,1793014921,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":29,"category_name":30,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":29,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":139,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":144,"read_time":145},962094243415,"https://ap-avatar.wpscdn.com/davatar_3d24733baf745e90a7e4bdd5f77d97b2","Cobalt Strike Basics  \n@TimMedin  \ntim@redsiege com  \n@RedSiege  \nJoeVest  \njoe.vest@helpsystems com  \nTIM ME DIN  \nCEO-Red Siege Information Security SANS Author – 560  \nSANS Instructor – 560, 660 IANS Faculty  \nPen Tester : More than a decade  \nOffensive : Forever  \n2  \nJOE VEST  \nTechnical Director – Cobalt Strike, Help Systems Author \"Red Development and Operations\"Original author of SANS564: Red Team Ops Red Teamer for decades  \n3  \nWHAT IS COBALT STRIKE?  \nCommand and Control framework for threat-based security tests  \n• Red Team  \n• Purple Team  \n• Pen Tests  \nCobalt Strike is like Photoshop. Photoshop doesn't create art for you . It provides the tools to a professional to create masterpieces . Both are only as good as the operator.  \nSET UP AND ARCHITECTURE  \nCOBALT STRIKE SETUP  \nTeam Server: Where listeners are configured and beacons are controlled Listener: Service running on the Team Server listening for callbacks  \nBeacon: Agent running on compromised host  \nReferences: [https://www.ired.team/offensive-security/red-team-infrastructure/cobalt-strike-101-installation-and-interesting-commands](https://www.ired.team/offensive-security/red-team-infrastructure/cobalt-strike-101-installation-and-interesting-commands)  \nTEAM SERVER  \nJava based server  \nDefault console port is 50050/tcp Defaults (a. k.a . Poor Opsec):  \nIdentify this host by connecting to port 50050  \nLook for the default TLS certificate on another port  \nBEACON COMMS  \nBuilt-in listeners for [HTTP/](HTTP/) [HTTPS and DNS](HTTPS and DNS)[ ](HTTPS and DNS)Multiple extensions exist to use other C2  \nDropbox  \nOneDrive  \nSlack  \nMany others – we'll discuss more options later  \nREDIRECTOR  \nUsed to protect (hide) the team server via proxy  \nAllows the attackers to burn the redirector and not have to build a new team-server  \nTeam server can send beacons to new redirectors (listeners) Methods: IPTables forwarding, SOCAT, ModRewrite  \nOther plugins allow for other protocols and cloud services  \nReferences: [https://www.ired.team/offensive-security/red-team-infrastructure/redirectors-forwarders](https://www.ired.team/offensive-security/red-team-infrastructure/redirectors-forwarders)  \nMALLEABLE C2","cbCaifGTPBmBjSGh","https://ap.wps.com/l/cbCaifGTPBmBjSGh","pdf",3366372,53,"English","# What is Cobalt Strike?\n# Set up and Architecture\n## Cobalt Strike Setup\n## Team Server\n## Beacon Comms\n## Redirector\n## Malleable C2","[{\"question\":\"What is Cobalt Strike used for?\",\"answer\":\"Cobalt Strike is a command and control framework for threat-based security tests, supporting Red Team, Purple Team, and pen tests.\"},{\"question\":\"What components make up Cobalt Strike setup?\",\"answer\":\"It includes a Team Server for listeners and beacon control, and Beacons running on compromised hosts that communicate back to the server.\"},{\"question\":\"How do beacons communicate with the Team Server?\",\"answer\":\"Beacons use built-in listeners such as HTTP, HTTPS, and DNS, with additional extensions available for other C2 approaches like cloud and messaging platforms.\"}]","Cobalt Strike Basics | PDF",1792886048,134]