BeaconHTTP Listener

Overview#

BeaconHTTP is an external listener that registers endpoints on the teamserver’s HTTP server. Beacon agents communicate with the teamserver over HTTP/HTTPS through these endpoints. Since it shares the teamserver’s TLS certificate and port, it blends naturally with the server’s web presence.

Characteristics#

Creating a BeaconHTTP Listener#

1. Open the Listeners tab in JustClient
2. Click Create (or right-click → New Listener)
3. Select BeaconHTTP from the listener type dropdown
4. Configure the listener parameters:

Parameters#

• Name — Unique identifier for this listener (e.g., http-primary)
• Bind Host — The host to bind to (typically 0.0.0.0)
• Bind Port — The port (shared with teamserver, typically 4321)
• Agent Address — The address agents will use to reach this listener (e.g., https://your-server.com:4321)

5. Click Start to activate the listener

How It Works#

1. The listener registers HTTP routes on the teamserver’s existing HTTP server
2. Beacon agents send HTTP requests (GET/POST) to these routes
3. The listener processes incoming agent data via InternalHandler()
4. Task responses are packed and returned in the HTTP response body
5. All traffic is encrypted by the teamserver’s TLS layer

OPSEC Notes#

• Traffic appears as normal HTTPS requests to the teamserver’s port
• The HTTP error page configuration in profile.yaml affects what unauthorized visitors see
• Customize the Server header and error responses to match your cover story
• Consider using a CDN or redirector in front of the teamserver for additional OPSEC
• HTTP/2 support can be enabled/disabled in the server configuration

Use Cases#

• Primary C2 channel — HTTP is the most versatile and widely allowed protocol
• Egress through proxies — HTTP traffic passes through most corporate proxies
• Domain fronting — Can be combined with CDN-based domain fronting techniques
• Long-haul operations — Reliable for extended engagements with configurable sleep intervals