Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/HavocFramework/Havoc/llms.txt

Use this file to discover all available pages before exploring further.

​
Overview

The job command provides a management interface for the Demon agent’s multi-threaded job system. Jobs are long-running tasks that execute in separate threads, such as BOF executions, SOCKS proxies, and port forwards.

​
Syntax

job [command] [job_id]

​
Subcommands

​
list

Displays all currently running jobs with their status and metadata. 
job list
​
job_id
integer
Unique identifier for the job
​
status
string
Current job status: Running, Suspended, or Completed
​
type
string
Type of job (BOF, SOCKS, PortForward, etc.)

​
suspend

Suspends a running job thread without terminating it. 
job suspend [job_id]
​
job_id
integer
required
The ID of the job to suspend (obtained from job list)

​
resume

Resumes a previously suspended job thread. 
job resume [job_id]
​
job_id
integer
required
The ID of the suspended job to resume

​
kill

Terminates a running or suspended job and removes it from the job list. 
job kill [job_id]
​
job_id
integer
required
The ID of the job to terminate

​
Examples

​
List All Jobs

job list
Example Output: 
Job ID | Status    | Type
-------|-----------|-------------
1      | Running   | BOF
2      | Running   | SOCKS Proxy
3      | Suspended | Port Forward

​
Suspend a Running Job

job suspend 1
Temporarily pauses job 1 without terminating it.

​
Resume a Suspended Job

job resume 3
Restarts job 3 that was previously suspended.

​
Kill a Job

job kill 2
Terminates and removes job 2 from the job list.

​
OPSEC Considerations

Long-running jobs PREVENT sleep obfuscation from occurring. Sleep masking only activates when there are no active job threads.

​
Job Thread Impact on Sleep Obfuscation

When jobs are running:
  • Sleep obfuscation is disabled: The agent cannot encrypt its memory while other threads are active
  • Memory footprint increases: Each job thread maintains its own stack and resources
  • Detection risk: Multiple threads may be more visible to EDR solutions

​
Best Practices

  1. Minimize Job Count: Only run necessary jobs to reduce the agent’s footprint
  2. Kill Completed Jobs: Use job kill to remove finished jobs and allow sleep obfuscation
  3. Monitor Job Status: Regularly check job list to identify hung or unnecessary jobs
  4. Suspend Instead of Kill: Use suspend for jobs you may need later to avoid re-initialization overhead

​
Use Cases

​
Managing SOCKS Proxies

# Start a SOCKS proxy (creates a job)
socket socks add 1080

# List jobs to get the job ID
job list

# When finished, kill the SOCKS proxy job
job kill 1

​
Controlling BOF Execution

# Execute a long-running BOF
inline-execute portscan.o go

# If it's taking too long, suspend it
job suspend 1

# Resume when needed
job resume 1

# Or kill it completely
job kill 1

​
Troubleshooting Hung Jobs

# Check for jobs that may be stuck
job list

# Kill any problematic jobs
job kill 2
job kill 3

​
Job States

The job thread is actively executing. This state:
  • Prevents sleep obfuscation
  • Consumes CPU and memory resources
  • Can be suspended or killed

​
Return Values

​
command
string
The job command that was executed (list, suspend, resume, kill)
​
job_id
integer
ID of the affected job (not present for list command)
​
status
string
Result of the operation: Success or Error
​
message
string
Additional information about the operation result
  • inline-execute - Execute BOFs that create jobs
  • socket - Manage SOCKS proxies and port forwards (creates jobs)
  • dotnet inline-execute - Run .NET assemblies in-process (creates CLR job)

​
Notes

  • Job IDs are assigned sequentially starting from 1
  • Suspended jobs still occupy memory and prevent sleep obfuscation
  • Some job types cannot be safely suspended (e.g., SOCKS connections)
  • Always kill jobs when they are no longer needed to enable sleep obfuscation
  • The agent automatically reports when jobs die unexpectedly

Build docs developers (and LLMs) love

Get started for freeTalk to us