Havoc vs Merlin
GitHub Stats
About Havoc
Havoc is a modern, malleable post-exploitation command and control framework. It features a cross-platform Qt-based GUI, support for Beacon Object Files (BOFs), custom agent development through its Agent SDK, and encrypted C2 communication. Havoc was designed as an open-source alternative to Cobalt Strike with a similar operator experience. It supports multiple listeners, team servers, and has a growing library of post-exploitation modules.
About Merlin
Merlin is a cross-platform post-exploitation Command and Control (C2) server and agent written in Go. It communicates over HTTP/2 and HTTP/3 (QUIC), leveraging modern protocols that many security tools and network monitors do not inspect. The server provides an interactive CLI for managing multiple agents, executing commands, uploading/downloading files, and running post-exploitation modules. Agents compile to single static binaries for Windows, Linux, and macOS. Merlin supports encrypted JWE/JWT communications, domain fronting, and multiple listener types for operational flexibility.
Platform Support
Tags
Shared
Havoc only
Merlin only