CS-Aggressor-Scripts

KO | EN

gitlite — search

#typescript #ai-agents #ai #dsh-plugin #deepseek-harness #open-source #cli #claude-code #codex #developer-tools #react #windows

CS-Aggressor-Scripts

★ 76 Open GitHub ↗

Aggressor Scripts for Cobalt Strike

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# CS-Aggressor-Scripts

Aggressor script for easier team collaboration with Cobalt Strike.

## Description

:information_source: This project contains CNA files for Cobalt Strike, parsers for automated editing of the CNA files, and guides to set up webhooks on the Slack application.

These CNA files will notify you via the Slack application when:

- A new client connects to the team server.
- A CS client disconnects from the team server.
- A new incoming beacon.
- A new web hit occurs.
- A CS client posts something in the event log.
- New site hosts.
- New credentials come in from keylogging.
- A new screenshot is taken from Cobalt Strike.

:information_source: The scripts are compatible with both the Windows and Linux operating systems.

The following table illustrates the CNA files included in this project:

## Acknowledgement

The official author of this project is [@sec_groundzero](https://twitter.com/sec_groundzero).

Special thanks to my friend [@nickvourd](https://twitter.com/nickvourd) for his contributions.

This aggressor script was inspired by [@bluescreenofjeff](https://twitter.com/bluescreenofjeff)'s projects.

## Table of Contents
- [CS-Aggressor-Scripts](#cs-aggressor-scripts)
  - [Description](#description)
  - [Acknowledgement](#acknowledgement)
  - [Table of Contents](#table-of-contents)
  - [Webhooks](#webhooks)
    - [Setup Slack and Webhooks](#setup-slack-and-webhooks)
  - [Parsers](#parsers)
    - [Linux Parser for Slack](#linux-parser-for-slack)
    - [Windows Parser for Slack](#windows-parser-for-slack)
  - [References](#references)

## Webhooks

### Setup Slack and Webhooks

:information_source: To set up a Slack server and webhook, you can follow these guides provided on the [Slack website](https://api.slack.com/incoming-webhooks).

## Parsers

In this project, there are two parsers that automate the editing of CNA file according to your personal preferences.

:information_source: However, you can manually edit the CNA files without using the parsers.

In the following table, the parsers of this project are presented:

### Linux Parser for Slack

The [Linux parser for Slack](/Parsers/Slack/slack-cna-parser_linux.sh) uses three mandatory arguments:

- hostname
- channel
- webhook

To run the linux parser, you should use the following usage:

```
./slack-cna-parser_linux.sh --channel "#XXXX" --hostname "XXXX" --webhook "https://hooks.slack.com/services/XXXX"
```

Example:

![linux-parser-example](https://raw.githubusercontent.com/secgroundzero/CS-Aggressor-Scripts/master/Pictures/linux-parser-example.png)

### Windows Parser for Slack

The [Windows parser for Slack](/Parsers/Slack/slack-cna-parser_windows.ps1) uses three mandatory arguments:

- hostname
- channel
- webhook

To run the windows parser, you should use the following usage:

```
.\slack-cna-parser_windows.ps1  -hostname "XXXX" -channel "#XXXX" -webhook "https://hooks.slack.com/services/XXXX"
```

Example:

![windows-parser-example](https://raw.githubusercontent.com/secgroundzero/CS-Aggressor-Scripts/master/Pictures/windows-parser-example.png)

## References

- [Aggressor Script Guide by Forta](https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/agressor_script.htm)
- [Slack Official Site](https://slack.com)
- [Sleep Language 2.1 Tutorial](http://sleep.dashnine.org/manual/)
- [Cobalt Strike Official Site](https://www.cobaltstrike.com)
- [AggressorScripts GitHub by bluscreenofjeff](https://github.com/bluscreenofjeff/AggressorScripts)

CS-Aggressor-Scripts

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README