Abusing Webhooks for Command and Control
Establishing covert command and control through HTTP webhooks on approved business websites.
Summary
Post-Exploitation Connectivity Challenge
Once inside a network, attackers need to exfiltrate data or execute commands on C2 servers. The problem is that outbound connectivity to C2 is often denied through DNS monitoring, ICMP blocking, and restricted cloud drive access.
Proxy and Filtering Evasion
Domain fronting for C2 may be ranked low by content proxies, restricting access to a handful of business websites. Traditional approaches trigger security alarms and reveal attacker presence.
Webhook-Based Solution
The technique uses HTTP callbacks (webhooks) to establish connectivity. Webhooks are used by organizations and can be leveraged as brokers for communication. Approved sites become communication channels, enabling data transfers and almost real-time command execution.
Implementation
Using approved sites as brokers allows bypassing strict defensive proxies and avoiding attribution. The tool released performs command-and-control communication through webhooks, fundamentally changing how attackers can maintain communication in restricted environments.
Related talks
Adversary Village·48 min
Jose Garduno
Jose Garduno introduces C2Centipede, an advanced C2 communication framework implementing Fast Flux, Domain Generation Algorithms (DGA), and resilient relays.
Red Team Village·23 min
Álvaro Rueda
Álvaro Rueda explores covert egress techniques and data exfiltration channels designed to bypass strict enterprise perimeter firewalls and DLP sensors.
Briefings·36 min
Adam Crosser
Red team operators frequently struggle with establishing interactive command and control (C2) over traditional C2 channels.