Network Topology

Network Topology

XoloC2 builds a live network graph from data collected by your beacons. Each beacon can scan its local network for neighbors — the results are parsed and rendered as an interactive vis.js graph in the Topology tab.

How it works

Running neighbors on a beacon makes it scan its local subnet using ARP requests and connection table inspection. No extra tools are needed on the target — the scan uses only OS-native utilities. Discovered IPs are returned as task output and automatically parsed by the server into graph nodes and edges.

Step 1 — Run neighbors on a beacon

In the session panel terminal, send:

neighbors

Output looks like:

192.168.1.1   (router)
192.168.1.50
192.168.1.101
192.168.1.200

The server parses this output and links each discovered IP to the beacon’s internal IP as a graph edge.

Step 2 — View the topology graph

Click Topology in the sidebar. The graph shows:

• Red nodes — active XoloC2 beacons (online)
• Grey nodes — active beacons (offline / not seen recently)
• White nodes — discovered neighbors (no beacon)
• Edges — which beacon discovered which neighbor

Hover over a node to see hostname and IP. Click a beacon node to jump to its session panel.

Step 3 — Expand the map

Run neighbors on each beacon you have access to. Each run adds more edges and nodes. Beacons on different subnets reveal different parts of the internal network.

# On beacon in 192.168.1.x subnet
neighbors

# On beacon in 10.10.0.x subnet (after pivoting)
neighbors

The graph updates automatically after each completed neighbors task.

Tips

• Run neighbors periodically to catch newly joined hosts
• Combined with SOCKS5 tunnels, the topology graph helps plan your pivot path — see which hosts are reachable from which beacon
• Nodes with no beacon are pivot targets: use the SOCKS5 tunnel on the nearest beacon to reach them

Notes

• The topology graph reflects the most recent completed neighbors task per beacon
• Internal IP is resolved from the beacon’s reported ip_internal field at check-in
• Beacons that never report an internal IP (e.g. NAT edge cases) will not appear in the graph