What I've Built
npm-c2
C2 channel that uses npm registry as communication infrastructure for red team operations. Implements serverless architecture leveraging whitelisted legitimate services. Features Python CLI operator with XOR-encrypted npm tokens, implant compiled as Node.js-masquerading EXE via PyInstaller, and dist-tag protocol with base64url encoding for commands. Communicates via HTTPS to npmjs.org with advanced OPSEC: credential obfuscation, gaussian jitter polling (60-80s), tags simulating CI/CD builds, and local state management. Demonstrates why trusted services become persistence vectors, teaching defensive teams to detect anomalies in legitimate traffic. Standalone implant generator, multi-architecture support (x64, ARM64, IA32), and file operations. Active development with evasion improvements. Listed on lolc2 registry.
Findings
Cross-Site Scripting on UCLM Intranet
Stored XSS vulnerability discovered on the intranet portal of Universidad de Castilla-La Mancha. Reported and disclosed through Open Bug Bounty.
View Report →npm-c2: C2 Over Package Registries
C2 channel using npm registry dist-tags as the transport layer. Listed on the lolc2 project registry as a living-off-the-land C2 technique.
View Project →Areas of Interest
Web Application Security
Black-box and white-box testing of web applications, APIs, and microservices. Focus on XSS, SSRF, injection flaws, and auth bypasses.
C2 Development
Building custom C2 channels over unconventional protocols - npm registries, DNS, and other trusted services. Focus on OPSEC and evasion.
Active Directory
Enumeration and exploitation of Active Directory environments: Kerberoasting, AS-REP roasting, delegation abuse and lateral movement across the domain.
Wireless Security
Wireless network security auditing: WPA2/3 assessment, rogue AP detection, deauthentication attacks, and enterprise 802.1X misconfiguration testing.
System Hardening
Security hardening and defensive configuration across the stack: Active Directory lockdown, Docker container security, web server reinforcement (Nginx, Apache), WordPress auditing, and OS-level hardening.