You've just completed the course.
Wohoo!
Before I let you go,
let's check out some additional information to take
your Merlin skills to the next level.
In this course, we focus on HTTP/3.
However, Merlin also supports attacks over HTTP/2.
For more information on version 2 attacks,
check out Russell's white paper,
a Practical Approach to Detecting and Preventing Web
Application Attacks over HTTP/2.
To note,
all of these links can be viewed within the Additional
Resources section within the course notes.
Merlin has a modules feature,
which allows you to save time by running pre‑bundled attacks.
This is a huge timesaver.
While we've primarily focused on Linux, Merlin has extensive Windows support.
For example, the Merlin Agent can be executed as a DLL.
For additional context and an example of running the DLL
without persisting the agent to disk, please check out Russell's blog post.
For additional background on Merlin, I recommend checking out this link,
which houses a variety of blog posts and videos.
You'll find information on the Merlin JavaScript Agent,
as well as guides on how to use Merlin.
Let's turn our focus onto some broader topics.
The C2 channel in this course, HTTP/3,
is an example of the web protocols sub‑technique.
For more information on these types of attacks, check out the MITRE link.
I'm going to provide a few resources on the core technology behind Merlin.
To take a deeper dive into HTTP/2, check out this Google article.
When compared to HTTP/2, there isn't as much information available on HTTP/3.
Well, at least at the time of this recording.
If you'd like to learn more about HTTP/3,
I recommend reading this doc from the QUIC working group.
Well, that's a wrap.
I hope this course was useful and allowed you to see the power
of Merlin within your red team workflow.
As always, I'd love to stay in contact.
If you'd like to contact me personally, please go to my website zachroofsec.com,
and also, feel free to follow me on Twitter.
I look forward to interacting with you.