Security Features

Security Features

This page summarizes the security mechanisms built into TOMCAT-C2 to protect C2 traffic and agent authentication during an engagement.

Encryption

• AES-256-GCM — All agent-to-server communication is encrypted end-to-end using AES-256 in Galois/Counter Mode, providing both confidentiality and integrity (authenticated encryption).

Authentication

• Mutual TLS (mTLS) — Agents authenticate to the server using client certificates stored in PKCS12 keystores, and the server authenticates to agents in turn. This prevents unauthorized clients from establishing a session even if they discover the listener.
• See Certificate Management for the full CA → Server → Agent certificate lifecycle.

Operational Security Recommendations

These are general good practices for operators running any C2 infrastructure, not specific claims about this codebase:

• Per-engagement infrastructure — Use a fresh CA, server certificate, and agent certificates for every engagement. Never reuse keystores between clients.
• Restrict listener exposure — Bind (-S) to the narrowest interface necessary; avoid 0.0.0.0 on infrastructure exposed to the public internet unless required.
• Enable mTLS in production engagements — Always pass -T, --mtls outside of local lab/testing scenarios.
• Secure the Web Panel — If using Web Panel mode, place it behind a VPN or restrict access by firewall/IP allowlist rather than exposing it directly.
• Clean up after engagements — Destroy certificates, keystores, and session logs once the engagement and reporting phase are complete, in line with your RoE and data retention agreement with the client.

Reporting a Vulnerability

If you discover a security issue in TOMCAT-C2 itself (as opposed to issues in target systems it's used against), please report it responsibly via the Issues page or directly to the maintainer, rather than disclosing it publicly first.

See Also

• Certificate Management
• Configuration