Home

Havoc Framework developer documentation

Welcome to the wiki of the community fork of Havoc. Havoc is a post-exploitation command and control framework: a Go teamserver that runs listeners and builds payloads, a Qt client for operators (multiplayer, scriptable in Python), and Demon, a Windows implant written in C/ASM. The upstream HavocFramework/Havoc project is no longer actively maintained; this fork continues development while staying protocol-compatible with upstream 0.7 ("Bites The Dust").

New here?

• Just want to run it? Start with Building From Source: dependencies, make targets, Docker, and known build issues.
• Want to configure it? See the Profile Reference (every field of the havoc.yaotl profile) and Listeners.
• Want to extend it? See Handlers (how third-party implants plug in), Building a Third-Party Agent and the Service API Reference, or the Client Python API for scripting the client.
• Found a bug or want to see what's planned? Check the fork's issue tracker; changes are logged in CHANGELOG.md.

This wiki documents the framework's internals from a full read of the source code. Havoc 0.7 consists of three main components:

Component	Location	Language	Purpose
Teamserver	teamserver/	Go	The C2 server: listeners, agent management, operator client handling, payload building, loot, database
Client	client/	C++ / Qt5 + embedded Python	The operator UI; connects to the teamserver over WebSocket; scriptable in Python
Demon	payloads/Demon	C (MinGW)	The built-in Windows implant (exe / dll / service / shellcode)

Pages

• Architecture Overview: how the pieces fit together
• Handlers: listener vs handler, and the two implant sides (Demon handler vs third-party agent handler)
• Building From Source: dependencies, make targets, Install.sh, known build issues
• Teamserver: Go server internals, startup flow, packages, database
• Profile Reference: every field of the havoc.yaotl teamserver profile
• Listeners: HTTP/HTTPS, SMB pivot and External listener internals
• Payload Generation: how the teamserver builds & patches Demon payloads, config keys
• Client: Qt client architecture and connection flow
• Client Teamserver Protocol: the WebSocket JSON protocol between operator client and teamserver
• Client Python API: the embedded havoc / havocui scripting API
• Demon Agent: the built-in implant: internals, command table, wire protocol
• Demon Console Commands: the full built-in agent console command set
• Tunneling: SOCKS5 and reverse port-forward through agents
• Building a Third-Party Agent: start here if you want to write your own implant
• Service API Reference: exact JSON message reference for the teamserver Service API

Quick pointers for third-party agent developers

1. Add a Service { Endpoint = "..."; Password = "..." } block to the teamserver profile. This exposes a WebSocket API on the teamserver.
2. Your "agent controller" connects to wss://<host>:<port>/<Endpoint> (TLS, same engine as the operator interface), authenticates, and registers your agent type with a unique 4-byte magic value (≠ 0xdeadbeef, which is Demon).
3. Your implant talks to any HTTP/External listener using a simple [size][magic][agentID][data] header; the teamserver forwards the data to your controller untouched (you own your crypto) and writes your reply back to the implant.
4. Full walkthrough: Building a Third-Party Agent. Message-by-message reference: Service API Reference.

A reference implementation exists upstream: Talon (agent) + havoc-py (Python Service-API library).

⚠️ This wiki documents the source code of this repository as-is, not the (sparse) official docs. Where behavior differs from the official wiki, trust the code.