Automated WAF rules and fingerprinting to detect DarkSword/P7 traffic patterns. Real-time blocking and logging with configurable thresholds.
- UA-based fingerprinting
- Request path pattern matching
- IP reputation scoring
- Configurable alerting
Intelligent version detection and payload injection. Automatic worker/module selection based on iOS version band plan.
- UA parsing & version grading
- Worker matrix lookup
- Staged payload delivery
- Crash recovery logic
N7Z2 encrypted channel implementation. Command execution with 30+ built-in commands. Multi-protocol support (HTTP/HTTPS).
- HMAC-SHA256-CTR encryption
- Command routing & execution
- Session management
- Heartbeat & keepalive
Real-time attack monitoring with live session tracking, beacon frequency analysis, and command execution statistics.
- Live session list
- Beacon per minute
- Command execution count
- Keychain dump tracking
$ darkwave --init
✓ Created API routes handler
✓ Generated C2 server code
✓ Set up telemetry collection
✓ Configured WAF rules
✓ Ready to deploy to Cloudflare
$ darkwave --deploy
✓ Pages function deployed
✓ Worker function deployed
✓ KV namespace created
✓ R2 bucket created
✓ DarkWave is live at https://darkwave.yourdomain.com
$ darkwave --stats
Active Sessions: 12
Beacons/minute: 84
Commands executed: 1523
Keychain dumps: 47