support

Listener Management

To manage your Cobalt Strike listeners, go to Cobalt Strike -> Listeners. This will open a tab listing all of your persistent listeners. Click Add to create a new listener.

Add a Listener

Add a Listener

Give your listener a memorable name. This is the name you will use to refer to it when you generate a social engineering package, pass a session, or set up a client-side attack.

Use the Payload dropdown to choose which payload this listener will serve.

The Host and Port field define where the payload will stage from. You may use a fully qualified domain name in the Host field.

Press Save to save the listener and start a server for the listener.

Other Options

The Listeners tab is your opportunity to manage your listeners. Highlight a listener and press Edit to change a listener.

Highlight one or more listeners and press Remove. This will stop these listeners and remove them from Cobalt Strike.

Use

You may use listeners with Cobalt Strike's attacks and post-exploitation features. These features will let you choose a listener by its name. Make sure you use a descriptive name for each of your listeners.

Foreign Listeners

Cobalt Strike supports the concept of foreign listeners. These are aliases for x86 payload handlers hosted in the Metasploit® Framework or other instances of Cobalt Strike. To pass a Windows HTTPS Meterpreter session to a friend with msfconsole, define a windows/foreign/reverse_https listener and point the Host and Port values to their handler. You may use foreign listeners anywhere you would use regular Cobalt Strike listeners.