Keklick is an advanced threat hunting platform designed to discover, map, and visualize command and control (C2) infrastructure. By identifying domains and IPs related to known malicious endpoints, security analysts can uncover complete C2 networks, helping to detect and mitigate malware campaigns and APT operations.
- C2 Infrastructure Discovery - Reveal domains and IPs connected to known malicious endpoints
- C2 Network Visualization - Map relationships between malicious infrastructure components
- Threat Intelligence Enrichment - Enhance findings with data from multiple intelligence sources
- Comprehensive C2 Reporting - Generate detailed PDF reports for incident response teams
- Interactive Analysis - Explore C2 networks through an intuitive graphical interface
- Multi-source Correlation - Connect data from DNS records, SSL certificates, and HTTP responses
- Advanced Filtering - Identify suspicious infrastructure by status codes and other attributes
- Docker and Docker Compose
- Python 3.9+ (if running without Docker)
- Go 1.21+ (if running without Docker)
- Minimum 2GB RAM
- 4GB+ free disk space
- Clone the repository:
git clone https://github.com/0x6rss/keklick.git
cd keklick- Build and run the Docker container:
-docker build -t keklick .
-docker run -p 5000:5000 keklick- Access the web interface at: http://localhost:5000
- Clone the repository:
git clone https://github.com/0x6rss/keklick.git
cd kecklick- Install Go (version 1.21 or later):
wget https://golang.org/dl/go1.21.0.linux-amd64.tar.gz
tar -C /usr/local -xzf go1.21.0.linux-amd64.tar.gz
export PATH=$PATH:/usr/local/go/bin- Install httpx:
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest- Install HEDnsExtractor:
git clone https://github.com/HuntDownProject/HEDnsExtractor.git
cd HEDnsExtractor
make
cp hednsextractor /usr/local/bin/
chmod +x /usr/local/bin/hednsextractor
cd ..- Install Python dependencies:
pip install -r requirements.txt- Run the application:
python app.py- Access the web interface at: http://localhost:5000
Keklick uses several external APIs for enhanced C2 detection. Add your API keys to improve hunting capabilities:
- Open app.py
- Locate the API_KEYS dictionary
- Replace the placeholder values with your actual API keys: API_KEYS = { "abuseipdb": "your_abuseipdb_api_key", "otx": "your_alienvault_otx_api_key" }
Keklick leverages powerful open-source tools for efficient and comprehensive C2 infrastructure discovery:
Keklick extensively uses httpx by ProjectDiscovery for probing potential C2 servers. This fast and multi-purpose HTTP toolkit allows for collecting detailed information about web servers, including status codes, redirects, and technologies in use - often revealing patterns consistent with C2 infrastructure.
HEDnsExtractor serves as a critical backend component for C2 infrastructure discovery. This tool enables Keklick to discover hidden domain names associated with known malicious IP addresses, helping to uncover entire C2 networks that might otherwise remain hidden.
Both tools form the backbone of Keklick's C2 hunting capabilities, enabling security teams to rapidly map out malicious infrastructure networks.
Kecklick integrates with several external services to enhance C2 hunting:
- AbuseIPDB - Check reputation data for suspicious IP addresses
- AlienVault OTX - Gather threat intelligence on potential C2 infrastructure
- VirusTotal - Verify malicious status across multiple security vendors
- Shodan - Identify additional services and vulnerabilities on C2 servers
- Censys - Discover related malicious infrastructure components
- FOFA - Find similar C2 servers and infrastructure
- URLScan.io - Analyze suspicious domains for C2 indicators and behavior
- Enter a known or suspected C2 domain or IP address in the search box
- Select the search type (Auto Detect, IP, or Domain)
- Set the result limit based on your investigation scope
- Click the search button to begin hunting
- Explore the visualization of the C2 infrastructure network
- Use the tools in the options menu for deeper analysis:
- Threat Intelligence to verify malicious status
- SSL Certificate Analysis to find related domains via certificates
- DNS Records to discover additional infrastructure
- WHOIS Information to identify ownership patterns
- Timeline for understanding infrastructure evolution
- Generate a comprehensive C2 infrastructure report using the Report button
Special thanks to:
- The ProjectDiscovery team for creating httpx (https://github.com/projectdiscovery/httpx)
- The HuntDownProject team for developing HEDnsExtractor (https://github.com/HuntDownProject/HEDnsExtractor)
- All the open-source projects and APIs that make Keklick possible
This project is licensed under the MIT License - see the LICENSE file for details.
Keklick is intended for legitimate security research and threat hunting purposes only. Always ensure you have proper authorization before scanning any systems or infrastructure. The developers take no responsibility for misuse of this tool.