Repositories list

• community_kit

  Public
  Cobalt Strike is a post-exploitation framework designed to be extended and customized by the user community. Several excellent tools and scripts have been writt…

  CSS

  •

  Apache License 2.0

  •2828 forks•417417 stars•00 issues•00 pull requests•Updated May 17, 2026May 17, 2026

• eden

  Public
  A PoC UDRL for Cobalt Strike built with Crystal Palace that combines Raphael Mudge's page streaming technique with a modular call gate (Draugr)

  C

  •

  Apache License 2.0

  •77 forks•124124 stars•11 issue•00 pull requests•Updated Jan 21, 2026Jan 21, 2026

• cobaltstrike-web-client

  Public
  A PoC web interface for interacting with Cobalt Strike through its REST API.

  HTML

  •22 forks•88 stars•00 issues•00 pull requests•Updated Jan 14, 2026Jan 14, 2026

• sleep2rest

  Public
  Library that provides Aggressor Script functions for interacting with the Cobalt Strike REST API from the client

  Apache License 2.0

  •11 fork•44 stars•00 issues•00 pull requests•Updated Dec 19, 2025Dec 19, 2025

• cobaltstrike-mcp-server

  Public
  MCP Server for Cobalt Strike interaction.

  Python

  •

  Apache License 2.0

  •77 forks•2121 stars•00 issues•22 pull requests•Updated Dec 19, 2025Dec 19, 2025

• .github

  Public
  00 forks•00 stars•00 issues•00 pull requests•Updated Dec 15, 2025Dec 15, 2025

• py2rest

  Public
  Library that provides Python examples for interacting with the Cobalt Strike REST API

  Jupyter Notebook

  •

  Apache License 2.0

  •33 forks•2424 stars•00 issues•00 pull requests•Updated Nov 26, 2025Nov 26, 2025

• bof_template

  Public
  A Beacon Object File (BOF) is a compiled C program, written to a convention that allows it to execute within a Beacon process and use internal Beacon APIs. BOFs…

  C

  •

  Apache License 2.0

  •2727 forks•269269 stars•00 issues•00 pull requests•Updated Nov 24, 2025Nov 24, 2025

• Malleable-C2-Profiles

  Public
  Malleable C2 is a domain specific language to redefine indicators in Beacon's communication. This repository is a collection of Malleable C2 profiles that you m…

  419419 forks•259259 stars•00 issues•00 pull requests•Updated Nov 24, 2025Nov 24, 2025

• icmp-udc2

  Public
  UDC2 implementation that provides an ICMP C2 channel

  Python

  •1717 forks•124124 stars•00 issues•00 pull requests•Updated Nov 24, 2025Nov 24, 2025

• udc2-vs

  Public
  User-Defined C2 BOF Template

  Python

  •

  Apache License 2.0

  •44 forks•3232 stars•00 issues•00 pull requests•Updated Nov 24, 2025Nov 24, 2025

• sleepmask-vs

  Public
  A simple Sleepmask BOF example

  C++

  •

  Apache License 2.0

  •3030 forks•173173 stars•00 issues•00 pull requests•Updated Nov 24, 2025Nov 24, 2025

• bof-vs

  Public
  A Beacon Object File (BOF) template for Visual Studio

  C++

  •

  Apache License 2.0

  •3838 forks•281281 stars•11 issue•22 pull requests•Updated Nov 24, 2025Nov 24, 2025

• aggressor_script_examples

  Public
  This repository contains tips, tricks, and examples of aggressor script functions. The intent is to share bite size examples that can be used in other scripts.

  Apache License 2.0

  •1010 forks•1818 stars•00 issues•00 pull requests•Updated Aug 12, 2025Aug 12, 2025

• teamserver-prop

  Public
  TeamServer.prop is an optional properties file used by the Cobalt Strike teamserver to customize the settings used to validate screenshot and keylog callback da…

  Apache License 2.0

  •1717 forks•7171 stars•00 issues•00 pull requests•Updated Aug 5, 2025Aug 5, 2025

• sleep_python_bridge

  Public
  This project is 'bridge' between the sleep and python language. It allows the control of a Cobalt Strike teamserver through python without the need for for the …

  Python

  •

  Apache License 2.0

  •3232 forks•188188 stars•00 issues•00 pull requests•Updated Aug 3, 2025Aug 3, 2025

• External-C2

  Public
  External C2 is a specification to allow third-party programs to act as a communication layer for Cobalt Strike’s Beacon payload.

  C

  •

  BSD 3-Clause "New" or "Revised" License

  •22 forks•1919 stars•00 issues•00 pull requests•Updated Jul 17, 2025Jul 17, 2025

• callback_examples

  Public
  This contains a number of examples demonstrating how to use callback functions in supported aggressor script functions

  C

  •

  Apache License 2.0

  •22 forks•3939 stars•00 issues•00 pull requests•Updated Mar 17, 2025Mar 17, 2025

• obfuscator-llvm

  Public
  C++

  •

  Other

  •7171 forks•5858 stars•00 issues•00 pull requests•Updated Jan 15, 2024Jan 15, 2024

• CallStackMasker

  Public
  A PoC implementation for dynamically masking call stacks with timers.

  C++

  •3838 forks•311311 stars•00 issues•00 pull requests•Updated Feb 13, 2023Feb 13, 2023

• unhook-bof

  Public
  Remove API hooks from a Beacon process.

  C

  •

  BSD 3-Clause "New" or "Revised" License

  •6161 forks•7777 stars•00 issues•00 pull requests•Updated Mar 13, 2022Mar 13, 2022

• ProxyDLLExample

  Public
  code for the Proxy DLL example blog post

  C

  •

  Apache License 2.0

  •1515 forks•6363 stars•00 issues•00 pull requests•Updated Oct 29, 2021Oct 29, 2021

• beacon_health_check

  Public
  This aggressor script uses a beacon's note field to indicate the health status of a beacon.

  Apache License 2.0

  •2323 forks•143143 stars•00 issues•00 pull requests•Updated Sep 29, 2021Sep 29, 2021

• cortana-scripts

  Public
  A collection of Cortana scripts that you may use with Armitage and Cobalt Strike 2.x. Cortana Scripts are not compatible with Cobalt Strike 3.x. Cobalt Strike 3…

  Java

  •286286 forks•33 stars•00 issues•00 pull requests•Updated Mar 2, 2021Mar 2, 2021

• sleep

  Public
  Automatically exported from code.google.com/p/sleep

  Java

  •

  BSD 3-Clause "New" or "Revised" License

  •1818 forks•11 star•00 issues•00 pull requests•Updated Oct 30, 2020Oct 30, 2020

• ZeroLogon-BOF

  Public
  C

  •

  BSD 3-Clause "New" or "Revised" License

  •3737 forks•1212 stars•00 issues•00 pull requests•Updated Sep 17, 2020Sep 17, 2020

• CVE-2020-0796-BOF

  Public
  C

  •1919 forks•55 stars•00 issues•00 pull requests•Updated Sep 17, 2020Sep 17, 2020

• ElevateKit

  Public
  The Elevate Kit demonstrates how to use third-party privilege escalation attacks with Cobalt Strike's Beacon payload.

  PowerShell

  •200200 forks•126126 stars•00 issues•00 pull requests•Updated Jun 22, 2020Jun 22, 2020

• vncdll

  Public
  Stand-alone VNC server compiled as a Reflective DLL

  C

  •

  GNU General Public License v2.0

  •5858 forks•55 stars•00 issues•00 pull requests•Updated Apr 20, 2019Apr 20, 2019