# trustedsec/trevorc2

TrevorC2 is a legitimate website (browsable) that tunnels client/server communications for covert command execution.

Repository: https://github.com/trustedsec/trevorc2
Canonical: https://ross.abutalabs.com/products/trevorc2
Language: C
License: NOASSERTION
License Family: other
Last push: 2022-01-31T20:16:24+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 3232, "days_push": 1675, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1344, forks 281 (observed 2026-08-28T04:04:27.142511+00:00)

## What it is
TrevorC2 is a client/server command-and-control framework that tunnels communications through a browsable, legitimate-looking website to evade detection. It hides commands in website content (e.g., before the </body> tag) and exfiltrates data without POST requests, using configurable timing intervals.

## Use cases
- set up a covert c2 channel that blends into normal web traffic
- red team command and control over http
- test detection of c2 traffic masquerading as legitimate browsing
- exfiltrate data without post requests
- clone a website as a cover for c2 server
- run implant communications over get requests only

## When to choose
- you need a lightweight, customizable c2 for authorized red team engagements
- you want c2 traffic that looks like normal HTTP GET browsing
- you need a portable client supporting Windows, macOS, and Linux

## When to avoid
- you need a full-featured production c2 framework with encryption and heavy randomization
- you want actively developed tooling with recent updates
- you need a supported, licensed enterprise product

## Facets
- artifact type: application
- maturity: maintenance
- function: security, http-client, http-server, cryptography
- domain: security, penetration-testing
- platform: windows, python, cli
- tags: command-and-control, c2, red-team, covert-channel, traffic-masquerading, offensive-security, command-line, linux, macos

## Member repositories
- trustedsec/trevorc2 (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:27.142511+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:42:51.137152+00:00, confidence not recorded.
  - readme: https://github.com/trustedsec/trevorc2 (fetched 2026-08-28T04:04:27.142511+00:00, sha 5d824ca1c931)
- Data as of 2026-08-30T08:39:29.467469+00:00.