infinitycurve.org

What It Is

InfinityCurve is a tool provider for offensive security. Its website primarily showcases two products: Havoc Professional and Kaine-kit. The former is a professional Command and Control framework and adversary emulation tool, while the latter is a cross-platform proxy and toolkit designed for Havoc, with an emphasis on evasion, extensibility, and malleable communications. This is not a traditional firewall, EDR, or vulnerability management platform; it is offensive-side infrastructure for authorized red team exercises, security assessments, and adversary emulation.

Core Capabilities and Deployment

Havoc Professional focuses on C2 framework extensibility: it supports server-side extensions, client-side Python/C++ scripts and plugins, custom Agents, Stage0 implants, and arbitrary covert communication channels. Its comparison table indicates that C2 channels such as DNS, HTTP, and SMB can be switched at runtime, and C2 profiles such as HTTP, DNS, DoH, and DoT can also be hot-swapped. For communication security, the page explicitly mentions X25519 key exchange and ChaCha20-Poly1305 end-to-end encryption. Kaine-kit covers Windows and Linux, supports x86_64 and AArch64, and maintains compatibility as far back as Windows XP. Its post-exploitation capabilities include BOF, Async BOF, Firebeam VM, SOCKS5, reverse port forwarding, UDP ASSOCIATE, and IPv6.

Management, Integrations, and Pricing

Management features mainly include Python API automation, client-side scripting, task orchestration, server log extensions, and a Ghostwriter plugin that can record agent activity and operator interactions to Ghostwriter in real time for reporting, auditing, and project retrospectives. On the integration side, it provides a custom Agent API, external C2/covert channels, and a plugin mechanism, making it suitable for red teams with development capabilities that want to build their own tradecraft. The page does not disclose pricing, licensing model, payment methods, trial options, SLA, support response times, or compliance certifications, so procurement cost and service assurances cannot be assessed.

Pros and Cons

The strengths are its clear, engineering-oriented architecture, with extensibility across C2, Agents, communications, scripting, and logging. Cross-platform and multi-architecture support is relatively comprehensive, while dynamic channels, malleable traffic, SOCKS5/reverse port forwarding, and related features are well suited to complex internal network exercises. The downside is that the product is highly offensive in positioning, so organizations must ensure clear authorization boundaries, operational auditing, and compliance workflows. At the same time, the lack of commercial transparency around pricing, certifications, and support makes procurement evaluation less straightforward.

Who It’s For and Access from China

It is better suited to mature red teams, offensive/defensive security labs, security consultancies, and enterprise security teams with in-house development capabilities. It is not suitable for users who only need basic protection or low-barrier security operations. The page does not provide information about access, payment, or delivery in mainland China, so these remain unknown. If procurement is constrained, alternatives to compare include Havoc Framework, other commercial C2/adversary emulation platforms, or locally compliant red team toolchains.