c2hunter
Open-source C2 hunting platform that correlates network traffic across sensors to detect, score, and investigate botnet command-and-control infrastructure
What XERJ indexed
Snapshot
The whole repository at commit 1b262ff628 (2026-10-25). master is 1 commit ahead.
Selected work
“preserve coverage and TCP observation correctness”. 22 files, 1,906 lines in analysis, web, controller.
Licence
The repository
LICENSE file checked at the pinned commit; the author agreed to inclusion.
The XERJ corpus
The author agreed by email on 2026-10-25. Same terms as the repository. Answers name the repo, the commit and the file:line.
selected for the XERJ Corpus Hublicence clearedsuggested use: adapt with attribution
blue-teambotnetc2command-and-controlcybersecurityddosincident-responsemalware-analysis
Example questions
- How does c2hunter implement blue-team?
- Where does c2hunter handle “preserve coverage and TCP observation correctness”?
- What does analysis do in c2hunter?
Inside the indexed corpus
- Languages by size: Python 81.5%, TypeScript 12.8%, Go 5.4%, JavaScript 0.2%, Shell 0.1%.
- On GitHub since 2026-07-20, last push 2026-10-26, 155 commits on master.
- The pin is 1 commit behind master; the corpus answers from the pinned code, not the newest.
Licence on GitHub and in the corpus
GitHub reported Apache-2.0 for piecer/c2hunter on 2026-10-29, and the LICENSE file at commit 1b262ff628 was reviewed as Apache-2.0. They match, so answers from this corpus carry the same terms as the live repository.
Contributors
piecer (@piecer) has 1 selected repository on the hub.
Using XERJ with c2hunter
- Batch lookup CVE and GHSA IDs offline in one query c2hunter is tagged cybersecurity on GitHub.
- Best MCP servers for local code search in 2026, compared
- Best grep alternative for AI coding agents (2026)
- Ask questions about a GitHub repo without cloning it
The prompt
Paste it into your AI agent. It clones piecer/c2hunter at the pinned commit and indexes it on your machine.
Search the GitHub repository piecer/c2hunter with XERJ (https://hub.xerj.org/corpus/piecer--c2hunter). Run these in a shell, in order, and check each result before the next: 1. xerj --help (success: it prints usage). If xerj is missing: curl -fsSL https://xerj.org/get | sh 2. git clone https://github.com/piecer/c2hunter c2hunter && git -C c2hunter checkout 1b262ff628a22aae8364152913747395225c0b44 3. Start a local node and leave it running: xerj --insecure --data-dir ./xerj-data 4. xerj autoindex ./c2hunter --url http://127.0.0.1:9200 --prefix c2hunter --progress plain 5. xerj autoindex map --url http://127.0.0.1:9200 Then answer my question from the indexed files and cite the ax_path of every hit. Query syntax: https://xerj.org/llms.txt Licence: Apache-2.0. Keep the copyright notice and credit the authors.
Related
piecerSecurity and vulnerabilities corporadispatchsplunk-security-contentcalderaSiddarthb07/corvexaniknohan/misp-phishing-threat-intelligence-lab0x0allenace/email-conversation-integrity-detection
Stats: GitHub API, fetched 2026-10-29. Selected work and consent: the XERJ registry.