Profile Wizard#

The dashboard includes a profile generation wizard for creating or importing C2 profiles without editing JSON/TOML/YAML by hand. Open it with the “+ New” button in the Profile Management section.

Import Mode#

Paste profile content or upload a file. The wizard auto-detects the profile type from the content:

Cobalt Strike: looks for Malleable C2 DSL patterns (http-get {, set sleeptime)
Havoc: looks for TOML markers ([[kaine)
PoshC2: looks for YAML markers (GET_Requests:)
JSON profiles: inspects top-level keys to distinguish Sliver (implant_config), Brute Ratel (listeners), Nighthawk (listener.http), Mythic HTTP (get/post with uris), and Mythic (agent_type)

The detected type shows as a badge next to the filename. Click “Validate” to parse the content through InfraGuard’s parser and confirm it’s well-formed before saving.

Imported profiles are saved to data/profiles/<filename>. Filenames containing /, \, .., or starting with . are rejected.

API#

POST /api/profiles/upload

{
  "content": "http-get { ... }",
  "filename": "jquery-c2.profile",
  "profile_type": "cobalt_strike",
  "dry_run": false
}

profile_type is optional – omit it to use auto-detection. Set dry_run: true to validate without saving.

Generate Mode#

Build a profile from scratch using a form. Select the target C2 framework from the dropdown, fill in the fields, and the wizard generates a valid profile in that framework’s native format.

Common Fields#

Field	Description
Profile name	Display name for the profile
User-Agent	Implant UA string. “Randomize” button picks from a built-in list.
Sleep time (ms)	Callback interval in milliseconds
Jitter (%)	Random sleep variation percentage
GET URIs	Request paths for GET callbacks (one per line)
POST URIs	Request paths for POST callbacks (one per line)
Client headers	Request headers sent by the implant (key-value pairs)
Server headers	Response headers returned by the C2 server (key-value pairs)
Message location	Where C2 data is carried: `cookie`, `header`, `parameter`, `body`, or `uri-append`
Message name	Name of the cookie/header/parameter used for data transport

Transforms#

Add an ordered chain of transforms applied to C2 data before transmission:

Action	Description
`base64`	Standard Base64 encoding
`base64url`	URL-safe Base64
`mask`	XOR mask
`netbios`	NetBIOS encoding (lowercase)
`netbiosu`	NetBIOS encoding (uppercase)
`prepend`	Prepend a string (requires value)
`append`	Append a string (requires value)

Supported Output Formats#

Profile Type	Output Format
`cobalt_strike`	`.profile` DSL
`sliver`	JSON
`brute_ratel`	JSON
`havoc`	TOML
`nighthawk`	JSON
`poshc2`	YAML
`mythic`	JSON

Every generated profile is validated by round-tripping it through InfraGuard’s parser for that framework. If the parser can’t read what was generated, the wizard shows an error instead of saving a broken profile.

API#

POST /api/profiles/generate

{
  "profile_type": "cobalt_strike",
  "params": {
    "name": "jQuery CDN",
    "useragent": "Mozilla/5.0 ...",
    "sleeptime": 60000,
    "jitter": 20,
    "get_uris": ["/jquery-3.7.1.min.js"],
    "post_uris": ["/submit.php"],
    "client_headers": {"Accept": "text/html"},
    "server_headers": {"Server": "Apache"},
    "message_location": "cookie",
    "message_name": "PHPSESSID",
    "transforms": [
      {"action": "base64"},
      {"action": "prepend", "value": "data="}
    ]
  },
  "filename": "jquery-cdn.profile",
  "dry_run": false
}

Set dry_run: true to preview the generated content without saving.

Profile Listing#

GET /api/profiles

Returns all profile files found in profiles/, examples/, data/profiles/, and directories of any profiles referenced in the domain config. The response includes file path, detected type, and parsed profile name.

Hot-Swap#

Swap a domain’s C2 profile at runtime without restarting InfraGuard:

PATCH /api/config/domains/{domain}/profile

{
  "profile_path": "data/profiles/jquery-cdn.profile",
  "profile_type": "cobalt_strike"
}

profile_type is optional – auto-detected from the file content if omitted. The endpoint validates the profile by parsing it before applying. If parsing fails, the previous profile stays active.

Phishing and tunnel profile types cannot be hot-swapped.

When running the dashboard in standalone mode (separate from the proxy), the request is forwarded to the proxy via the INFRAGUARD_PROXY_API environment variable.