What is fox3?

fox3 is a command-and-control (C2) server, which is the backend tooling used in red team and penetration testing operations. In plain terms, security professionals use it to manage "agents", small programs they've deployed on a target machine, so they can send those agents tasks and receive results back, all through a web browser interface instead of a traditional command line. The way it works is straightforward at a high level. An agent on a target machine sends an encrypted message to a "listener" (a server endpoint waiting for check-ins). The server decrypts the message, queues up any pending jobs for that agent, and sends those jobs back in the same response. Meanwhile, the person running the operation (the operator) watches everything through a React-based web dashboard that updates in real time. All communication between agent and server is encrypted, and there's no command-line interface for the operator, the browser console is the only way to interact with it. This is built for security researchers, red teams, and penetration testers who need a lightweight way to manage compromised machines during a simulated attack. For example, a red team operator might deploy an agent on a Windows workstation, then use the web dashboard to tell that agent to run commands, grab data, or maintain access. The project currently supports several types of network listeners (HTTP/1.1, HTTP/2, H2C, HTTP/3), with more traditional channels like TCP, DNS, and SMB listed as coming soon. A few notable design choices stand out. The project uses SQLite for storing state, which keeps things simple and self-contained rather than requiring a separate database server. It's written in Go for the backend with a React frontend. Some advanced modules are Windows-only, which makes sense given that Windows is the most common target in enterprise environments. The project is actively in development and is licensed under GPLv3.