Slimper

# Slimper Command and Control framework.
## Introduction
This file contains the documentation about the Command and Control (C2) framework named Slimper.\
This framework is private and developed for educational purposes. This is the only documentation existing on this framework.

A C2 framework allows an attacker to communicate with the compromised victim machines after a successful cyber intrusion.

Implants are executables generated by the C2 framework to create a backdoor.
The operator of the C2 framework (attacker) needs to drop, install and start the execution of the implant himself.

To handle communication between the C2 server and the implants, Slimper uses the HTTP protocol.


Slimper uses a heartbeat system using HTTP requests. A heartbeat is a periodic signal generated by the implant to indicate its availability to the C2 server.


## Server and implants
In Slimper, the C2 server is an internet-facing HTTP server that receives requests from the implants.\
Slimper only uses GET and POST methods to handle its communication.

The C2 server is controlled by an operator (attacker), communicates the commands to the implants and then receives the results of the executed commands.

To send a command to an implant, the C2 server waits for an HTTP request from the implant and then responds with an HTTP response containing the command from the operator of the C2 server in its body.\
If no command is sent, the HTTP response body is empty.

The implants send heartbeat HTTP requests to the C2 Server. A heartbeat is a periodical signal generated to indicate the implant's availability.\
If the HTTP response contains a command from the C2 server, the implant is in charge to execute it and return the result in a POST request.

The URIs used in these HTTP requests are built as described in the following sections.



### File extensions
- **`.js`**: Used for heartbeat. It uses the GET method.
- **``**: No extension is used for carrying data. It uses the POST method.
- **`.png`**: Indicates that the HTTP requests from the implant will stop and the implant will kill its processes. It uses the GET method.

### Dictionaries