[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-653160-105":3,"detail-sidebar-cat-0-en-105":85,"doc-detail-653160-en":134},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":78,"head_meta":80,"extra_data":82,"updated_unix":84},105,"en","cobalt-strike-user-guide","Cobalt Strike - User Guide","","Cobalt Strike User Guide provides a structured reference for deploying, configuring, and operating Cobalt Strike components across a team server, clients, REST API, and distributed workflows. It explains user interface elements, data management, target and service organization, listener and infrastructure management, and beacon payload behaviors including HTTP/HTTPS, DNS, SMB, TCP, and external C2 options. The guide also covers scripting and automation, post-exploitation workflows, pivoting techniques, malleable command and control, and reporting/logging and OPSEC considerations.",{"@graph":14,"@context":77},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/document/","Document",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/document/technology/","Technology",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/document/cobalt-strike-user-guide/653160/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/cobalt-strike-user-guide/653160.png","ImageObject",300,407,{"name":42,"@type":43},"bocahgabuttt","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-30","2026-10-24",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",6,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69,73],{"name":60,"@type":61,"acceptedAnswer":62},"What components does Cobalt Strike use when starting up a deployment?","Question",{"text":63,"@type":64},"The guide covers starting the team server, starting a Cobalt Strike client, and starting the REST API server, along with distributed and team operations. It also describes how different services and infrastructure elements fit together.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"How are beacon payloads configured and communicated across different protocols?",{"text":68,"@type":64},"It explains beacon payload staging and multiple beacon types, including HTTP/HTTPS, DNS, SMB, TCP, and options for external C2 and user-defined C2. It also includes how infrastructure consolidation and foreign listeners are managed.",{"name":70,"@type":61,"acceptedAnswer":71},"What capabilities are covered for post-exploitation and operational control?",{"text":72,"@type":64},"The guide documents beacon job control, process and desktop control, privilege escalation, credential and hash harvesting, and other post-exploitation commands. It also details how commands execute and how data is stored and interpreted.",{"name":74,"@type":61,"acceptedAnswer":75},"How does browser pivoting work and what proxying options are available?",{"text":76,"@type":64},"It outlines browser pivoting concepts and mechanisms, including SOCKS proxying, reverse port forwarding, spawn and tunnel techniques, pivot listeners, and covert VPN. It also covers SSH sessions and related command execution steps.","https://schema.org",{"og:url":32,"og:type":79,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":81,"canonical":32},"index,follow",{"doc_id":83,"site_id":7},653160,1793080579,{"code":4,"msg":86,"data":87},"success",[88,92,96,100,105,108,113,118,123,126,130],{"id":22,"doc_module":4,"doc_module_name":25,"category_name":89,"show_sort_weight":90,"slug":91},"Story & Novel",90,"story-novel",{"id":26,"doc_module":4,"doc_module_name":25,"category_name":93,"show_sort_weight":94,"slug":95},"Literature",80,"literature",{"id":33,"doc_module":4,"doc_module_name":25,"category_name":97,"show_sort_weight":98,"slug":99},"Exam",70,"exam",{"id":101,"doc_module":4,"doc_module_name":25,"category_name":102,"show_sort_weight":103,"slug":104},5,"Comic",60,"comic",{"id":55,"doc_module":4,"doc_module_name":25,"category_name":29,"show_sort_weight":106,"slug":107},50,"technology",{"id":109,"doc_module":4,"doc_module_name":25,"category_name":110,"show_sort_weight":111,"slug":112},7,"Healthcare",40,"healthcare",{"id":114,"doc_module":4,"doc_module_name":25,"category_name":115,"show_sort_weight":116,"slug":117},8,"Research & Report",30,"research-report",{"id":119,"doc_module":4,"doc_module_name":25,"category_name":120,"show_sort_weight":121,"slug":122},9,"Religion & Spirituality",20,"religion-spirituality",{"id":121,"doc_module":4,"doc_module_name":25,"category_name":124,"show_sort_weight":121,"slug":125},"World Cup","world-cup",{"id":127,"doc_module":4,"doc_module_name":25,"category_name":128,"show_sort_weight":127,"slug":129},10,"Lifestyle","lifestyle",{"id":131,"doc_module":4,"doc_module_name":25,"category_name":132,"show_sort_weight":101,"slug":133},19,"General","general",{"code":4,"msg":86,"data":135},{"doc_id":83,"user_id":136,"nickname":42,"user_avatar":137,"doc_module":4,"category_id":55,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":138,"file_id":139,"file_url":140,"file_type":141,"file_size":142,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":143,"language":144,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":145,"faqs":146,"seo_title":147,"seo_description":12,"update_tm":148,"read_time":149},962094248839,"https://ap-avatar.wpscdn.com/davatar_994ba38a5ba835b3df7d355c54d3ed8d","Cobalt Strike  \nUser Guide  \nCopyright © Fortra, LLC and its group of companies. All trademarks and registered trademarks are the property of their respective owners.  \nThe content in this document is protected by the Copyright Laws of the United States of America and other countries worldwide. The unauthorized use and/or duplication of this material without express and written permission from Fortra is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Fortra with appropriate and specific direction to the original content.  \n202609280255-4.12  \nTable of Contents  \nWelcome to Cobalt Strike  12  \nOverview  12  \nInstallation and Updates  13  \nStarting the Team Server  21  \nStarting a Cobalt Strike Client  23  \nStarting the REST API Server  25  \nDistributed and Team Operations  26  \nScripting Cobalt Strike  28  \nRunning the Client on macOS  29  \nCobalt Strike Research Labs  31  \nUser Interface  33  \nOverview  33  \nToolbar  33  \nPreferences: Look and Feel Options  34  \nSession and Target Visualizations  35  \nConsoles  37  \nTables  39  \nWorking with Tabs  40  \nUser Defined Tab Completion  41  \nKeyboard Shortcuts  45  \nData Management  47  \nCobalt Strike User Guide [www.fortra.com](www.fortra.com) page: iii  \nOverview  47  \nTargets  47  \nServices  48  \nCredentials  48  \nMaintenance  48  \nListener and Infrastructure Management  50  \nOverview  50  \nListener Management  50  \nCobalt Strike’s Beacon Payload  52  \nPayload Staging  55  \nDNS Beacon  55  \n[HTTP Beacon](HTTP Beacon) and [HTTPS Beacon](HTTPS Beacon)  61  \nSMB Beacon  68  \nTCP Beacon  71  \nExternal C2  74  \nUser-Defined C2  76  \nForeign Listeners  86  \nInfrastructure Consolidation  87  \nPayload Store  88  \nInitial Access  91  \nClient-side System Profiler  91  \nApplication Browser  91  \nCobalt Strike Web Services  92  \nCobalt Strike User Guide [www.fortra.com](www.fortra.com) page: iv  \nUser-driven Attack Packages  92  \nHosting Files  104  \nUser-driven Web Drive-by Attacks  105  \nClient-side Exploits  109  \nClone a Site  110  \nSpear Phishing  110  \nPayload Artifacts and Anti-virus Evasion  114  \nThe Artifact Kit  114  \nThe Veil Evasion Framework  116  \nJava Applet Attacks  116  \nThe Resource Kit  117  \nThe Sleep Mask Kit  117  \nPost Exploitation  120  \nBeacon Covert C2 Payload  120  \nThe Beacon Console  120  \nThe Beacon Menu  121  \nAsynchronous and Interactive Operations  122  \nRunning Commands  122  \nSession Passing  178  \nAlternate Parent Processes  179  \nSpoof Process Arguments  179  \nBlocking DLLs in Child Processes  180  \nUpload and Download Files  180  \nCobalt Strike User Guide [www.fortra.com](www.fortra.com) page: v  \nFile Browser  181  \nThe Windows Registry  182  \nKeystrokes and Screenshots  182  \nControlling Beacon Jobs  183  \nJob Browser  183  \nProcess Browser  184  \nDesktop Control  185  \nPrivilege Escalation  186  \nMimikatz  190  \nCredential and Hash Harvesting  190  \nPort Scanning  191  \nNetwork and Host Enumeration  191  \nTrust Relationships  192  \nLateral Movement  194  \nLateral Movement GUI  195  \nBeacon Data Store  196  \nBeacon Interpreter  197  \nC Script User Guide  199  \nPostex Kit  211  \nOther Commands  215  \nBrowser Pivoting  216  \nOverview  216  \nSetup  216  \nCobalt Strike User Guide [www.fortra.com](www.fortra.com) page: vi  \nUse  217  \nHow Browser Pivoting Works  218  \nPivoting  219  \nWhat is Pivoting  219  \nSOCKS Proxy  219  \nReverse Port Forward  220  \nSpawn and Tunnel  221  \nPivot Listeners  222  \nCovert VPN  224  \nSSH Sessions  227  \nThe SSH Client  227  \nRunning Commands  228  \nUpload and Download Files  228  \nPeer-to-peer C2  229  \nSOCKS Pivoting and Reverse Port Forwards  229  \nMalleable Command and Control  230  \nOverview  230  \nChecking for Errors  230  \nProfile Language  231  \n[HTTP Staging](HTTP Staging)  240  \nA Beacon [HTTP Transaction Walk-through](HTTP Transaction Walk-through)  241  \n[HTTP Host Profiles](HTTP Host Profiles)  242  \n[HTTP Server Configuration](HTTP Server Configuration)  245","cbCair0A1ZpRjMtB","https://ap.wps.com/l/cbCair0A1ZpRjMtB","pdf",12488458,717,"English","# Welcome to Cobalt Strike\n## Overview\n## Installation and Updates\n## Starting the Team Server\n## Starting a Cobalt Strike Client\n## Starting the REST API Server\n## Distributed and Team Operations\n## Scripting Cobalt Strike\n## Running the Client on macOS\n## Cobalt Strike Research Labs\n# User Interface\n## Toolbar\n## Preferences: Look and Feel Options\n## Session and Target Visualizations\n## Consoles\n## Tables\n## Working with Tabs\n## Keyboard Shortcuts\n# Data Management\n## Targets\n## Services\n## Credentials\n## Listener Management\n## Cobalt Strike’s Beacon Payload\n# Initial Access\n## Client-side System Profiler\n## Application Browser\n## Cobalt Strike Web Services\n## User-driven Attack Packages\n## Hosting Files\n# Post Exploitation\n## Beacon Covert C2 Payload\n## The Beacon Console\n## Controlling Beacon Jobs\n## Desktop Control\n## Privilege Escalation\n## Credential and Hash Harvesting\n# Browser Pivoting\n## How Browser Pivoting Works\n## SOCKS Proxy\n## Reverse Port Forward\n## Covert VPN\n## SSH Sessions\n# Malleable Command and Control\n## Profile Language\n## HTTP Staging\n## HTTP Host Profiles\n## SSL Beacon\n# Aggressor Script and BOFs\n## How to Load Scripts\n## The Script Console\n## Headless Cobalt Strike\n# Reporting and Logging\n## Activity Report\n## Hosts Report\n## Sessions Report\n## Reporting and Logging\n# Appendix\n## Keyboard Shortcuts\n## Beacon Command Behavior and OPSEC Considerations","[{\"question\":\"What components does Cobalt Strike use when starting up a deployment?\",\"answer\":\"The guide covers starting the team server, starting a Cobalt Strike client, and starting the REST API server, along with distributed and team operations. It also describes how different services and infrastructure elements fit together.\"},{\"question\":\"How are beacon payloads configured and communicated across different protocols?\",\"answer\":\"It explains beacon payload staging and multiple beacon types, including HTTP/HTTPS, DNS, SMB, TCP, and options for external C2 and user-defined C2. It also includes how infrastructure consolidation and foreign listeners are managed.\"},{\"question\":\"What capabilities are covered for post-exploitation and operational control?\",\"answer\":\"The guide documents beacon job control, process and desktop control, privilege escalation, credential and hash harvesting, and other post-exploitation commands. It also details how commands execute and how data is stored and interpreted.\"},{\"question\":\"How does browser pivoting work and what proxying options are available?\",\"answer\":\"It outlines browser pivoting concepts and mechanisms, including SOCKS proxying, reverse port forwarding, spawn and tunnel techniques, pivot listeners, and covert VPN. It also covers SSH sessions and related command execution steps.\"}]","Cobalt Strike - User Guide | PDF",1792886045,1807]