JustC2 Docs
JustC2 Docs
Comenzar
Comenzar

REST API Reference

Overview

The JustC2 teamserver exposes a REST API over HTTPS. All endpoints are prefixed with the configured endpoint path (default: /endpoint). Authentication uses JWT bearer tokens.

Authentication

Login

POST /endpoint/login
Content-Type: application/json

{
  "username": "operator1",
  "password": "mypassword",
  "version": "1.2"
}

Response:

{
  "access_token": "eyJhbGciOiJIUzI1NiIs...",
  "refresh_token": "eyJhbGciOiJIUzI1NiIs..."
}

Refresh Token

POST /endpoint/refresh
Content-Type: application/json

{
  "refresh_token": "eyJhbGciOiJIUzI1NiIs..."
}

Response:

{
  "access_token": "eyJhbGciOiJIUzI1NiIs..."
}

Using Tokens

Include the access token in all subsequent requests:

Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

WebSocket Connection

Sync and Connect

POST /endpoint/sync
Authorization: Bearer <access_token>

Generates an OTP for WebSocket connection:

POST /endpoint/otp/generate
Authorization: Bearer <access_token>

Connect via WebSocket:

GET /endpoint/connect?otp=<otp_token>

Subscriptions

POST /endpoint/subscribe
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "categories": ["agents", "tasks", "downloads"],
  "console_team_mode": true
}

Listeners

List Listeners

GET /endpoint/listener/list
Authorization: Bearer <access_token>

Create Listener

POST /endpoint/listener/create
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "name": "http-primary",
  "config_type": "BeaconHTTP",
  "config": "{...}"
}

Edit Listener

POST /endpoint/listener/edit

Stop Listener

POST /endpoint/listener/stop

Pause/Resume Listener

POST /endpoint/listener/pause
POST /endpoint/listener/resume

Agents

List Agents

GET /endpoint/agent/list
Authorization: Bearer <access_token>

Generate Agent Payload

POST /endpoint/agent/generate
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "agent_name": "beacon",
  "config": "{...}",
  "listeners_name": ["http-primary"]
}

Remove Agent

POST /endpoint/agent/remove
Content-Type: application/json

{
  "agent_id": "abc12345"
}

Execute Command

POST /endpoint/agent/command/execute
Content-Type: application/json

{
  "agent_name": "beacon",
  "agent_id": "abc12345",
  "cmdline": "shell whoami",
  "args": {}
}

File Command

POST /endpoint/agent/command/file

Raw Command

POST /endpoint/agent/command/raw

Update Agent Data

POST /endpoint/agent/update/data
POST /endpoint/agent/set/tag
POST /endpoint/agent/set/mark
POST /endpoint/agent/set/color

Tasks

List Tasks

GET /endpoint/agent/task/list?agent_id=abc12345&limit=50&offset=0

Cancel Task

POST /endpoint/agent/task/cancel
Content-Type: application/json

{
  "agent_id": "abc12345",
  "task_id": "task001"
}

Delete Task

POST /endpoint/agent/task/delete

Task Hook

POST /endpoint/agent/task/hook

Save Task

POST /endpoint/agent/task/save

Chat

Send Message

POST /endpoint/chat/send
Content-Type: application/json

{
  "message": "Starting lateral movement phase"
}

Downloads

List Downloads

GET /endpoint/download/list

Sync Download

POST /endpoint/download/sync
Content-Type: application/json

{
  "file_id": "dl001"
}

Delete Downloads

POST /endpoint/download/delete
Content-Type: application/json

{
  "file_ids": ["dl001", "dl002"]
}

Screenshots

List Screenshots

GET /endpoint/screen/list

Get Screenshot Image

GET /endpoint/screen/image?screen_id=scr001

Set Note

POST /endpoint/screen/setnote

Remove Screenshot

POST /endpoint/screen/remove

Credentials

List

GET /endpoint/creds/list

Add

POST /endpoint/creds/add
Content-Type: application/json

{
  "username": "admin",
  "password": "P@ssw0rd",
  "realm": "CORP.LOCAL",
  "type": "plaintext",
  "host": "10.0.0.5"
}

Edit / Remove / Set Tag

POST /endpoint/creds/edit
POST /endpoint/creds/remove
POST /endpoint/creds/set/tag

Targets

List

GET /endpoint/targets/list

Add / Edit / Remove / Set Tag

POST /endpoint/targets/add
POST /endpoint/targets/edit
POST /endpoint/targets/remove
POST /endpoint/targets/set/tag

Tunnels

List

GET /endpoint/tunnel/list

Start Tunnels

POST /endpoint/tunnel/start/socks5
POST /endpoint/tunnel/start/socks4
POST /endpoint/tunnel/start/lportfwd
POST /endpoint/tunnel/start/rportfwd

Stop Tunnel

POST /endpoint/tunnel/stop

Set Info

POST /endpoint/tunnel/set/info

Services

List Services

GET /endpoint/service/list

Call Service

POST /endpoint/service/call
Content-Type: application/json

{
  "function": "myFunction",
  "args": "{...}"
}

OTP Endpoints

These require OTP authentication instead of JWT:

Upload Temporary File

POST /endpoint/otp/upload/temp

Download Sync

GET /endpoint/otp/download/sync

Error Handling

All API endpoints return JSON responses:

Success:

{
  "ok": true,
  "data": { ... }
}

Error:

{
  "ok": false,
  "message": "Error description"
}

Unauthenticated or unrecognized requests receive the configured HTTP error page (default: 404 with the custom error page).

Prev
Pivoting
Next
Extender Development