JustC2 Docs
JustC2 Docs
Comenzar
Comenzar

HTTP Server Configuration

Error Response Configuration

When the server receives a request that doesn’t match any registered endpoint or fails authentication, it returns a configurable error response. This is critical for OPSEC — the error page should look like a legitimate web server.

HttpServer:
  error:
    status: 404
    headers:
      Content-Type: "text/html; charset=UTF-8"
      Server: "nginx/1.26.2"
    page: "404page.html"
FieldTypeDescription
statusintHTTP status code for error responses (default: 404)
headersmapCustom HTTP headers included in error responses
pagestringPath to the HTML file served as the error page body

Customizing Error Responses

To impersonate a specific web server:

nginx:

headers:
  Content-Type: "text/html; charset=UTF-8"
  Server: "nginx/1.26.2"
  X-Powered-By: ""

Apache:

headers:
  Content-Type: "text/html; charset=iso-8859-1"
  Server: "Apache/2.4.57 (Ubuntu)"

IIS:

headers:
  Content-Type: "text/html"
  Server: "Microsoft-IIS/10.0"
  X-Powered-By: "ASP.NET"

Replace 404page.html with an HTML file that matches the target server’s default error page.

HTTP Settings

HttpServer:
  http:
    max_header_bytes: 8192
    read_header_timeout_sec: 0
    read_timeout_sec: 0
    write_timeout_sec: 0
    idle_timeout_sec: 0
    request_timeout_sec: 300
    request_timeout_message: "504 Gateway Timeout"
    disable_keep_alives: false
    enable_http2: true
FieldTypeDefaultDescription
max_header_bytesint8192Maximum size of request headers in bytes
read_header_timeout_secint0Timeout for reading request headers (0 = no limit)
read_timeout_secint0Timeout for reading the entire request (0 = no limit)
write_timeout_secint0Timeout for writing the response (0 = no limit)
idle_timeout_secint0Timeout for idle keep-alive connections (0 = no limit)
request_timeout_secint300Per-request middleware timeout in seconds
request_timeout_messagestring"504 Gateway Timeout"Message returned when a request exceeds the timeout
disable_keep_alivesboolfalseDisable HTTP keep-alive connections
enable_http2booltrueEnable HTTP/2 protocol support

Timeout Recommendations

For most engagements, the defaults work well. Adjust when:

  • Long-running operations: Increase request_timeout_sec if agent payload builds take longer than 5 minutes
  • High-security environments: Set read_header_timeout_sec and idle_timeout_sec to prevent slowloris-style resource exhaustion
  • HTTP/2: Leave enable_http2: true unless you specifically need to avoid HTTP/2 fingerprinting

Example: Hardened Profile

HttpServer:
  error:
    status: 404
    headers:
      Content-Type: "text/html; charset=UTF-8"
      Server: "nginx/1.26.2"
      X-Content-Type-Options: "nosniff"
      X-Frame-Options: "SAMEORIGIN"
    page: "404page.html"
  http:
    max_header_bytes: 8192
    read_header_timeout_sec: 10
    read_timeout_sec: 30
    write_timeout_sec: 30
    idle_timeout_sec: 120
    request_timeout_sec: 300
    request_timeout_message: "504 Gateway Timeout"
    disable_keep_alives: false
    enable_http2: true
  tls:
    min_version: "TLS1.2"
    max_version: "TLS1.3"
    prefer_server_cipher_suites: true
    cipher_suites:
      - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
      - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
      - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
      - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
Prev
SSL/TLS Setup
Next
First Launch