BotnetGoV2 (Deprecated Project)

A Command & Control (C2) system for network testing and resilience evaluation. Built in Go for performance and cross-platform support.

Disclaimer: This tool is for educational and authorized security testing only. Unauthorized use is prohibited.

Screenshots

Watch Demo Video

Project Layout

├── cnc/                 # C2 server
│   ├── cfg.go           # constants / config
│   ├── types.go         # shared type definitions
│   ├── main.go          # entry point, TLS listeners
│   ├── tui.go           # terminal UI, command loop, animations
│   ├── auth.go          # user auth, bcrypt, quotas
│   ├── token.go         # JWT sessions, refresh, revocation
│   ├── acl.go           # RBAC permission system
│   ├── bots.go          # bot registry, heartbeat, diagnostics
│   ├── wire.go          # binary packet protocol
│   ├── api.go           # REST API (HTTPS)
│   ├── pool.go          # TLS connection pooling
│   ├── store.go         # thread-safe bounded collections
│   ├── throttle.go      # rate limiting
│   ├── log.go           # structured logging
│   ├── check.go         # input validation
│   └── data/
│       ├── certs/       # TLS certs (server.crt, server.key)
│       ├── geo/         # MaxMind GeoIP databases
│       ├── gifs/        # terminal animations (.tfx)
│       ├── json/        # rbac.json, users.json
│       └── logs/        # runtime logs
│
├── device/              # bot client
│   ├── bot.go           # bot logic, packet protocol, attack methods
│   └── build.sh         # cross-compile for linux targets
│
├── gifs/                # source .gif files
├── gif.py               # GIF → TFX converter
└── tut.md               # setup & usage guide

Architecture

Component	Port	Protocol
Bot listener	7002	Custom binary over TLS
User terminal	420	ANSI TUI over TLS
REST API	8443	HTTPS

Security

• TLS 1.3 enforced on all connections
• bcrypt password hashing with constant-time comparison
• JWT sessions with refresh tokens, revocation, and IP binding
• RBAC with per-method granularity
• Rate limiting on auth, attacks, API, commands, and connections
• Bounded data structures to prevent memory exhaustion
• Input validation on all user-supplied data

Quick Start

C2 Server

cd cnc
# place server.crt + server.key in data/certs/
go build -o c2 .
./c2

Bot Client

Edit the C2 address in device/bot.go, then:

cd device
go build -o bot .
./bot

Cross-compile for IoT targets:

cd device
chmod +x build.sh
./build.sh
# binaries in build/

GIF Converter

pip install Pillow numpy
python gif.py gifs/crow.gif cnc/data/gifs/crow.tfx

Terminal Commands

Command	Description
help	Show command list
bots	Connected bot count
botstatus	Bot telemetry dashboard
methods	Available attack methods
ongoing	Current attack status
allattacks	All active attacks
stopattack	Stop running attack
attackhistory	Past attacks
gif list	List animations
gif <name>	Play animation
clear	Clear screen
logout	Disconnect

Admin / Owner

Command	Description
adduser	Create user account
deluser	Delete user account
users	List all users
rbac	View/edit permissions
admin	Admin command panel
owner	Owner command panel
!reinstall	Reinstall all bots (owner)

Attack Methods

Format: !method ip port duration

Layer 4: !udp !udpsmart !tcp !syn !ack !rst !gre

Layer 4+: !vse !xmas !pps !stomp

Amplification: !amp

REST API

Auth: API token + secret (generated per user via adduser)

Method	Endpoint	Description
POST	/api/attack	Launch attack
GET	/api/bots	List bots
GET	/api/stats	Server stats

User Roles

Role	Access
Owner	Full system control
Admin	User management, method auth
Pro	All attack methods
Basic	!udp, !tcp only