Hands-On Red Team Tactics

Customizing the team server

The team server is just a bash script that executes the cobaltstrike.jar file for starting the server. By default, the Armitage team server runs on port 55553/tcp and the Cobalt Strike team server runs on port 50050/tcp (both use SSL for communication initiation). Being the default port, it's easy for someone else to find your team server on the internet and try to connect to it in order to get access to your compromised hosts. Consequently, to protect your team server from attacks, you need to think of a few ways to protect it from other attackers. These may include the following:

• Use a strong password for team server authentication [EASY]
• Whitelist your IP from the team server firewall and deny all other IPs ...