fox3
C2 teamserver. Go backend, React frontend, SQLite state. Agents check in over encrypted HTTP — the browser console is the only operator interface.
How it works
Agents POST JWE-encrypted messages to a listener on every sleep cycle. The server decrypts, processes results, queues any pending jobs, and returns the batch in the same HTTP response. Operators see everything live in the browser through a WebSocket-pushed dashboard.
agent ──POST /──► listener ──► server ──► operator browser
JWE decrypts, queues WebSocket push
Quick start
Requires Go 1.24+ and GCC (CGO for the SQLite driver).
git clone https://github.com/nzyuko/fox3
cd fox3
go build -o fox3_server .
./fox3_server --password <your-password>
# Open http://localhost:8080
Documentation
| Frontend guide | UI walkthrough with screenshots — start here |
| Building | Windows, Linux, macOS build instructions |
| Configuration | All flags and defaults |
| Listeners | Listener types, options, TLS setup |
| Commands | Every agent command with args |
| API reference | Full WebSocket action/event reference |
| Architecture | Internals — request flow, crypto, DB schema |
Status
Active development. HTTP/1.1, HTTP/2, H2C, HTTP/3 listeners work. TCP/UDP/SMB/DNS planned. Some modules (HVNC, CLR, Minidump, token) are Windows-only by design.
| Component | Status |
|---|---|
| HTTP/HTTPS/H2C/HTTP2/HTTP3 listeners | working |
| Agent management, job dispatch | working |
| React dashboard | working |
| SOCKS5 tunnel, reverse port-forward | working |
| HVNC streaming | working (Windows agent) |
| TCP / UDP / SMB listeners | coming soon |
| DNS / DoH listeners | coming soon |