-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathRemoteControl.html
More file actions
1246 lines (1148 loc) · 76.1 KB
/
Copy pathRemoteControl.html
File metadata and controls
1246 lines (1148 loc) · 76.1 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
<title>Web Remote Control System: Manage Windows Devices from Your Browser</title>
<meta name="description"
content="Web-based remote control for Windows: live desktop stream, mouse & keyboard input, file transfer, Task Manager, remote terminal, and self-hosted SignalR dashboard.">
<meta name="keywords"
content="web remote control, web based remote control, remote web control, web controller, Windows remote desktop browser, live screen control, file transfer, Task Manager, remote terminal, ASP.NET Core, Blazor, SignalR, .NET 9, real-time monitoring, device control, remote access, self-hosted">
<meta name="author" content="OffCode">
<meta name="last-modified" content="2026-07-19">
<meta name="robots" content="index, follow">
<!-- Security Headers -->
<meta property="og:type" content="website">
<meta property="og:url" content="https://www.dev-offcode.com/RemoteControl.html">
<meta property="og:title" content="Web Remote Control System: Manage Windows Devices from Your Browser">
<meta property="og:description"
content="Web-based remote control for Windows: live desktop stream, file transfer, Task Manager, and remote terminal from your browser.">
<meta property="og:image" content="https://www.dev-offcode.com/RemoteControl1.png">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:url" content="https://www.dev-offcode.com/RemoteControl.html">
<meta name="twitter:title" content="Web Remote Control System: Manage Windows Devices from Your Browser">
<meta name="twitter:description"
content="Web-based remote control for Windows: live desktop stream, file transfer, Task Manager, and remote terminal from your browser.">
<meta name="twitter:image" content="https://www.dev-offcode.com/RemoteControl1.png">
<link rel="canonical" href="https://www.dev-offcode.com/RemoteControl.html">
<link rel="alternate" hreflang="en" href="https://www.dev-offcode.com/RemoteControl.html">
<link rel="alternate" hreflang="x-default" href="https://www.dev-offcode.com/RemoteControl.html">
<link rel="icon" type="image/x-icon" href="/favicon.ico">
<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
<link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
<link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
<link rel="manifest" href="/manifest.json">
<!-- Preload critical resources -->
<link rel="preload" href="styles.css?v=2.9.5" as="style">
<link rel="preload" href="gallery-simple.css?v=2.8.0" as="style">
<link rel="preload" href="RemoteControl1.png" as="image">
<!-- Core Web Vitals optimization -->
<meta name="theme-color" content="#00ff88">
<meta name="msapplication-TileColor" content="#00ff88">
<!-- Structured Data Schema -->
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "SoftwareApplication",
"name": "Web Remote Control System",
"applicationCategory": "UtilitiesApplication",
"operatingSystem": "Windows",
"description": "Web-based remote control for Windows: live desktop stream, mouse and keyboard input, Task Manager, streaming file transfer, remote terminal, and AES-256-GCM security.",
"url": "https://www.dev-offcode.com/RemoteControl.html",
"image": "https://www.dev-offcode.com/RemoteControl1.png",
"offers": {
"@type": "Offer",
"price": "0",
"priceCurrency": "USD",
"availability": "https://schema.org/InStock"
},
"downloadUrl": "https://www.dev-offcode.com/RemoteControl.html",
"inLanguage": ["en"],
"author": {
"@type": "Person",
"@id": "https://www.dev-offcode.com/#author",
"name": "EmptyCode0x86",
"url": "https://www.dev-offcode.com"
},
"publisher": {
"@type": "Organization",
"@id": "https://www.dev-offcode.com/#organization",
"name": "OffCrypt",
"url": "https://www.dev-offcode.com",
"logo": {
"@type": "ImageObject",
"url": "https://www.dev-offcode.com/RemoteControl1.png"
}
},
"softwareVersion": "2.7.0",
"releaseNotes": "Remote control system with ASP.NET Core backend, Blazor frontend, SignalR real-time communication, and Windows agent integration",
"datePublished": "2025-01-01",
"dateModified": "2026-07-19"
}
</script>
<!-- FAQ Schema -->
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "FAQPage",
"mainEntity": [
{
"@type": "Question",
"name": "What is Web Remote Control System?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Web Remote Control System is a self-hosted, web-based remote control for Windows. From the browser you get a live desktop stream, mouse and keyboard input, process management, streaming file transfer, remote terminal, and an optional Dashboard lock password on the control panel."
}
},
{
"@type": "Question",
"name": "Does it work remotely over the internet?",
"acceptedAnswer": {
"@type": "Answer",
"text": "The system uses ASP.NET Core backend with SignalR for real-time communication. A lightweight Windows agent runs on the target device to execute commands. The connection is established through the web interface."
}
},
{
"@type": "Question",
"name": "Can I view and control the remote screen?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Yes, the Live Stream feature provides a real-time feed of the remote desktop directly to your web browser. You can interact with the machine by sending mouse clicks and inputs instantly over a highly optimized SignalR connection."
}
},
{
"@type": "Question",
"name": "Can I transfer files securely?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Yes! The system includes a high-performance streaming file manager. You can browse directories, and reliably upload or download massive files without hitting memory limits. Progress is displayed in real time."
}
},
{
"@type": "Question",
"name": "What technologies does it use?",
"acceptedAnswer": {
"@type": "Answer",
"text": "The system stack includes ASP.NET Core (API + SignalR) for backend, Blazor Server for the web UI, SQLite via EF Core for storage, and a Windows agent (C#/.NET) that executes commands on the target device."
}
},
{
"@type": "Question",
"name": "Is the connection secure against packet sniffing?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Absolutely. The system implements AES-256 GCM encryption for all sensitive data transfers. Even if traffic is intercepted by tools like Wireshark, the data is completely unreadable. A Server Manager securely generates and embeds the Master Keys directly into the Agent stub."
}
}
]
}
</script>
<link rel="stylesheet" href="styles.css?v=2.9.5">
<link rel="stylesheet" href="gallery-simple.css?v=2.8.0">
</head>
<body>
<!-- Sidebar Navigation -->
<aside class="sidebar">
<div class="sidebar-header">
<div class="sidebar-title">OffCode</div>
</div>
<nav class="sidebar-nav">
<ul class="sidebar-menu">
<li class="menu-item">
<a href="index.html" class="menu-link">
<span class="menu-icon">📱</span>
<span class="menu-text">Android App</span>
</a>
</li>
<li class="menu-item">
<a href="OffCryptDesktop.html" class="menu-link">
<span class="menu-icon">💻</span>
<span class="menu-text">Desktop App</span>
</a>
</li>
<li class="menu-item">
<a href="ScreenLockBuilder.html" class="menu-link">
<span class="menu-icon">🔒</span>
<span class="menu-text">Screen Lock Builder</span>
</a>
</li>
<li class="menu-item">
<a href="ScreenLockBuilderPremium.html" class="menu-link">
<span class="menu-icon">⭐</span>
<span class="menu-text">Premium Builder</span>
</a>
</li>
<li class="menu-item">
<a href="AutomationTool.html" class="menu-link">
<span class="menu-icon">🤖</span>
<span class="menu-text">Automation Tool</span>
</a>
</li>
<li class="menu-item active">
<a href="RemoteControl.html" class="menu-link">
<span class="menu-icon">🌐</span>
<span class="menu-text">Web Remote Control</span>
</a>
</li>
<li class="menu-item">
<a href="TorChatPage.html" class="menu-link">
<span class="menu-icon">🧅</span>
<span class="menu-text">Tor Chat</span>
</a>
</li>
<li class="menu-item">
<a href="https://ko-fi.com/emptyc0de" class="menu-link" target="_blank" rel="noopener noreferrer">
<span class="menu-icon">💝</span>
<span class="menu-text">Donate</span>
</a>
</li>
<li class="menu-item">
<a href="PrivacyPolicy.html" class="menu-link">
<span class="menu-icon">🔐</span>
<span class="menu-text">Privacy Policy</span>
</a>
</li>
</ul>
</nav>
<div class="sidebar-footer">
<p class="footer-text">Social media</p>
<div class="sidebar-social-divider"></div>
<div class="sidebar-social">
<a href="https://x.com/OffCryptAndroid" target="_blank" rel="noopener noreferrer"
aria-label="Follow OffCrypt on X">
<span class="sidebar-social-icon">🐦</span>
<span class="sidebar-social-label">X</span>
</a>
<a href="https://www.instagram.com/off.crypt86/" target="_blank" rel="noopener noreferrer"
aria-label="Follow OffCrypt on Instagram">
<span class="sidebar-social-icon">📸</span>
<span class="sidebar-social-label">Instagram</span>
</a>
<a href="https://www.tiktok.com/@offcrypt0" target="_blank" rel="noopener noreferrer"
aria-label="Follow OffCrypt on TikTok">
<span class="sidebar-social-icon">🎵</span>
<span class="sidebar-social-label">TikTok</span>
</a>
<a href="https://www.youtube.com/@OffCrypt" target="_blank" rel="noopener noreferrer"
aria-label="Follow OffCrypt on YouTube">
<span class="sidebar-social-icon">▶️</span>
<span class="sidebar-social-label">YouTube</span>
</a>
<a href="https://bsky.app/profile/off-crypt86.bsky.social" target="_blank" rel="noopener noreferrer"
aria-label="Follow OffCrypt on Bluesky">
<span class="sidebar-social-icon">🦋</span>
<span class="sidebar-social-label">Bluesky</span>
</a>
<a href="https://www.linkedin.com/in/off-crypt-b94175382/" target="_blank" rel="noopener noreferrer"
aria-label="Follow OffCrypt on LinkedIn">
<span class="sidebar-social-icon">💼</span>
<span class="sidebar-social-label">LinkedIn</span>
</a>
</div>
</div>
</aside>
<!-- Mobile Menu Toggle -->
<button class="mobile-menu-toggle" aria-label="Toggle Menu">
<span class="hamburger"></span>
</button>
<!-- Main Content Wrapper -->
<div class="main-wrapper">
<main>
<section class="intro-section">
<div class="intro-container">
<div class="intro-content">
<!-- Hero Header -->
<h1 class="hero-title">🌐 Web Remote Control System</h1>
<p class="hero-subtitle">Free & Self-hosted Windows Device Management</p>
<div class="hero-glow-divider"></div>
<p class="intro-description lead-text">
The Web Remote Control System is a <strong>completely free</strong>,
<strong>self-hosted</strong>, web-based remote control for Windows. A lightweight Windows
Agent pairs with a Blazor dashboard so you can live-stream the desktop, send mouse and
keyboard input, move files, open a remote terminal, and manage processes from any browser, without sitting at the machine.
</p>
<p class="intro-description">
<strong>AES-256 GCM Encryption:</strong> The system is built with security as its absolute
foundation. All sensitive payloads and communication between the Agent and the Backend are
encrypted end-to-end using AES-256 GCM. This guarantees that even if your connection is
intercepted using packet sniffers like Wireshark, the data remains completely unreadable and
protected. A dedicated <strong>Server Manager</strong> tool securely generates cryptographic
Master Keys and directly embeds them into the Agent executables, ensuring zero-configuration
deployment without compromising security.
</p>
<p class="intro-description">
<strong>Live Stream & Interactive Control:</strong> Experience a high-performance, real-time
visual feed of the remote desktop directly inside your web browser. Send precision mouse
clicks, inputs, and movements instantly to the target device via an optimized SignalR
connection, granting you seamless, interactive control as if you were sitting right in front
of the monitor.
</p>
<p class="intro-description">
<strong>Server Manager & Deployment:</strong> Starting your own management server is easier
than ever with the dedicated <strong>Server Manager</strong> tool. It provides a one-click
interface to launch both the backend and frontend services, handles automatic project path
detection, and cryptographically ensures all sensitive payloads and communication between
the Agent and the Backend are encrypted end-to-end using AES-256 GCM. The Server Manager
also acts as an automated stub builder, creating customized remote agents that are
pre-configured to connect only to your self-hosted instance.
</p>
<div class="intro-highlights">
<div class="highlight-item">
<span class="highlight-icon">🖥️</span>
<span class="highlight-text">Live Screen Control</span>
</div>
<div class="highlight-item">
<span class="highlight-icon">📁</span>
<span class="highlight-text">Streaming Transfers</span>
</div>
<div class="highlight-item">
<span class="highlight-icon">⚙️</span>
<span class="highlight-text">Task Manager</span>
</div>
<div class="highlight-item">
<span class="highlight-icon">🔒</span>
<span class="highlight-text">AES-256 GCM Encryption</span>
</div>
</div>
</div>
</div>
</section>
<!-- Modern Horizontal Scrolling Gallery -->
<section id="pictures" class="image-gallery-container">
<div class="gallery-header">
<h2 class="gallery-title" style="color: white;">💻 Screenshot & Video Showcase</h2>
</div>
<div class="image-card video-showcase-card" data-image="youtube-demo" data-title="Web Remote Control Demo"
data-desc="Watch the Web Remote Control System in action.">
<div class="video-ratio-wrap">
<iframe src="https://www.youtube.com/embed/_gMLGK7DUUI"
title="Web Remote Control Demo Video"
allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share"
referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
</div>
<div class="video-card-label">▶ Web Remote Control: Demo Video</div>
</div>
<div class="image-gallery">
<div class="image-card featured" data-image="RemoteControl1.png" data-title="Remote Control Session"
data-desc="Live streaming and interactive remote control in action">
<img src="RemoteControl1.png" alt="Remote Control Live Stream interface">
<div class="image-overlay">
<div class="zoom-icon">🔍</div>
</div>
</div>
<div class="image-card" data-image="DeviceHistory.png" data-title="Device History"
data-desc="See previously connected devices with names and status for faster reconnection">
<img src="DeviceHistory.png" alt="Remote Control Device History interface">
<div class="image-overlay">
<div class="zoom-icon">🔍</div>
</div>
</div>
<div class="image-card" data-image="Dashboardlock.png" data-title="Dashboard Lock"
data-desc="Secure your control panel with optional password protection">
<img src="Dashboardlock.png" alt="Remote Control Dashboard Lock interface">
<div class="image-overlay">
<div class="zoom-icon">🔍</div>
</div>
</div>
<div class="image-card" data-image="FileManager.png" data-title="Streaming File Manager"
data-desc="Browse remote directories and transfer massive files securely">
<img src="FileManager.png" alt="Remote Control File Manager interface">
<div class="image-overlay">
<div class="zoom-icon">🔍</div>
</div>
</div>
<div class="image-card" data-image="TaskManager.png" data-title="Remote Task Manager"
data-desc="Monitor and control active processes and resource usage">
<img src="TaskManager.png" alt="Remote Control Task Manager interface">
<div class="image-overlay">
<div class="zoom-icon">🔍</div>
</div>
</div>
<div class="image-card" data-image="SoftwareManager.png" data-title="Software Manager"
data-desc="List installed applications and uninstall remotely via Windows Registry">
<img src="SoftwareManager.png" alt="Remote Control Software Manager interface">
<div class="image-overlay">
<div class="zoom-icon">🔍</div>
</div>
</div>
<div class="image-card" data-image="OpenProcess.png" data-title="Remote Process Execution"
data-desc="Instantly execute commands and launch software on the agent machine">
<img src="OpenProcess.png" alt="Remote Control Open Process interface">
<div class="image-overlay">
<div class="zoom-icon">🔍</div>
</div>
</div>
<div class="image-card" data-image="RemoteTerminal.png" data-title="Remote Terminal"
data-desc="Fully interactive PowerShell and Command Prompt terminal in the web dashboard">
<img src="RemoteTerminal.png" alt="Remote Control Terminal interface">
<div class="image-overlay">
<div class="zoom-icon">🔍</div>
</div>
</div>
<div class="image-card" data-image="ScriptManager.png" data-title="Script Manager"
data-desc="Built-in code editor to write, save, and execute scripts on remote agent machines">
<img src="ScriptManager.png" alt="Remote Control Script Manager interface">
<div class="image-overlay">
<div class="zoom-icon">🔍</div>
</div>
</div>
<div class="image-card" data-image="ScriptManager2.png" data-title="Script Manager (Jobs)"
data-desc="Track running and completed scripts in real-time, safely stop execution, and view output">
<img src="ScriptManager2.png" alt="Remote Control Script Manager Jobs interface">
<div class="image-overlay">
<div class="zoom-icon">🔍</div>
</div>
</div>
<div class="image-card" data-image="ComputerInfo.png" data-title="System Telemetry"
data-desc="View detailed hardware metrics and operating system information">
<img src="ComputerInfo.png" alt="Remote Control Computer Information interface">
<div class="image-overlay">
<div class="zoom-icon">🔍</div>
</div>
</div>
<div class="image-card" data-image="LiveRemote.png" data-title="Live Remote Control"
data-desc="Real-time visual feed and interactive desktop control">
<img src="LiveRemote.png" alt="Remote Control Live Remote interface">
<div class="image-overlay">
<div class="zoom-icon">🔍</div>
</div>
</div>
<div class="image-card" data-image="ChatRemote.png" data-title="Two-way Chat"
data-desc="Real-time messaging between the dashboard administrator and the remote user">
<img src="ChatRemote.png" alt="Remote Control Chat interface">
<div class="image-overlay">
<div class="zoom-icon">🔍</div>
</div>
</div>
<div class="image-card" data-image="RemotControlManager.png" data-title="Server Manager Tool"
data-desc="Easily manage servers, generate security keys, and build custom agents">
<img src="RemotControlManager.png" alt="Remote Control Server Manager interface">
<div class="image-overlay">
<div class="zoom-icon">🔍</div>
</div>
</div>
</div>
</section>
<!-- Custom Image Modal -->
<div id="imageModal" class="image-modal">
<div class="modal-content">
<span class="close">×</span>
<img id="modalImage" src="" alt="">
<div class="modal-info">
<h3 id="modalTitle"></h3>
<p id="modalDesc"></p>
</div>
</div>
</div>
<!-- Modern Section Divider -->
<div class="section-divider"></div>
<!-- Features Section -->
<section id="features" class="features-section">
<div class="features-container">
<h2 class="features-title">Features</h2>
<p class="features-subtitle">Everything you need for self-hosted remote Windows management</p>
<p class="features-carousel-hint">Browse the cards with the arrows or by swiping to see every feature</p>
<div class="features-carousel" id="features-carousel" data-features-carousel>
<button type="button" class="features-carousel-btn prev" aria-label="Previous features"
aria-controls="features-carousel-track">
<span aria-hidden="true">‹</span>
</button>
<button type="button" class="features-carousel-btn next" aria-label="Next features"
aria-controls="features-carousel-track">
<span aria-hidden="true">›</span>
</button>
<div class="features-carousel-track" id="features-carousel-track" role="region"
aria-roledescription="carousel" aria-label="Product features" tabindex="0">
<div class="feature-card">
<div class="feature-icon">🔐</div>
<h3>AES-256 GCM encryption</h3>
<p>Application-layer encryption for sensitive hub traffic so payloads stay protected
end-to-end.</p>
<ul class="feature-list">
<li>Encrypts command and file-transfer payloads between agent, API, and dashboard</li>
<li>Large file bodies use <strong>chunked AES-256-GCM</strong> with per-transfer keys and <code>X-Transfer-Token</code> (HMAC)</li>
<li>Designed so passive packet capture does not expose secrets in clear text</li>
<li>Server Manager helps distribute keys into agent builds for your deployment</li>
</ul>
</div>
<div class="feature-card">
<div class="feature-icon">🖥️</div>
<h3>Live stream & remote control</h3>
<p>View the remote desktop in the browser and send mouse and keyboard input in real time.
</p>
<ul class="feature-list">
<li>Adjustable stream quality and frame rate (up to 240 FPS)</li>
<li>Dynamic zoom controls with mouse-wheel tracking</li>
<li>Interactive control over SignalR for responsive remote desktop use</li>
<li><strong>Share Screen:</strong> Share the live stream via a secure, public link without dashboard login; set a custom expiry (hours + minutes) or <strong>No time limit</strong>: expired links are automatically invalidated</li>
</ul>
</div>
<div class="feature-card">
<div class="feature-icon">💬</div>
<h3>Chat</h3>
<p>Real-time two-way chat window between the dashboard administrator and the remote agent’s user.</p>
<ul class="feature-list">
<li>Messages delivered instantly over the encrypted SignalR channel</li>
<li>Customizable administrator nickname and persistent message history</li>
</ul>
</div>
<div class="feature-card">
<div class="feature-icon">📁</div>
<h3>Streaming file manager</h3>
<p>Browse drives and folders, upload and download large files without loading everything
into memory.</p>
<ul class="feature-list">
<li>Quick paths for Desktop, Documents, Downloads, Program Files, AppData, and more</li>
<li>Drive list from the agent for fixed, removable, and network volumes</li>
<li>Optional <strong>Upload and run</strong> to open a transferred file on the agent
after upload</li>
<li><strong>File Search:</strong> Search by name with wildcard and recursive subdirectory support (up to 500 results)</li>
<li>Agent HTTP legs store/transfer ciphertext (<code>.rcenc</code>); paths validated with an agent path allowlist</li>
</ul>
</div>
<div class="feature-card">
<div class="feature-icon">📸</div>
<h3>Desktop screenshot</h3>
<p>Capture a JPEG preview of the remote desktop from the control panel.</p>
<ul class="feature-list">
<li>Quality and resolution suited for quick diagnostics</li>
<li><strong>Close Image</strong> dismisses the preview without leaving the page</li>
</ul>
</div>
<div class="feature-card">
<div class="feature-icon">⚙️</div>
<h3>Task manager, process blocker & power controls</h3>
<p>Inspect running processes, block unwanted applications, and control power state remotely.</p>
<ul class="feature-list">
<li>Process list and termination from the web UI</li>
<li><strong>Process Blocker:</strong> Block apps by name, agent kills them instantly on startup; setting persists in the Windows Registry across reboots</li>
<li>Power controls for shutdown and restart through the dashboard workflow</li>
</ul>
</div>
<div class="feature-card">
<div class="feature-icon">📦</div>
<h3>Software manager</h3>
<p>List installed applications on the agent using Windows registry data and uninstall
remotely.</p>
<ul class="feature-list">
<li>Inventory style listing suitable for maintenance windows</li>
<li>Silent-style uninstall flow driven from the hub</li>
</ul>
</div>
<div class="feature-card">
<div class="feature-icon">🚀</div>
<h3>Remote process execution</h3>
<p>Launch commands, open files, or start programs on the agent from the dashboard.</p>
<ul class="feature-list">
<li>Path and arguments sent over the encrypted control channel</li>
<li>Useful for tooling, installers, and scripted maintenance</li>
</ul>
</div>
<div class="feature-card">
<div class="feature-icon">⌨️</div>
<h3>Remote terminal</h3>
<p>Fully interactive PowerShell and Command Prompt terminal directly in the web dashboard.
</p>
<ul class="feature-list">
<li>Real-time command execution and output streaming</li>
<li>Direct access to the remote command line</li>
</ul>
</div>
<div class="feature-card">
<div class="feature-icon">📝</div>
<h3>Script manager</h3>
<p>Built-in code editor to write, save, and execute scripts on remote agent machines.</p>
<ul class="feature-list">
<li>Supports Python, PowerShell, Batch, and VBScript</li>
<li>Scripts saved in browser’s local storage for easy reuse</li>
<li><strong>Scheduled Script Execution:</strong> Set specific dates and times for scripts to run automatically</li>
<li><strong>Job-based tracking:</strong> Agent keeps running and completed scripts in memory, close the browser and resume; output is preserved</li>
<li><strong>Stop Script:</strong> Safely and asynchronously terminate a running script at any time</li>
<li><strong>Download Output:</strong> Save script execution output directly to a local file</li>
</ul>
</div>
<div class="feature-card">
<div class="feature-icon">💻</div>
<h3>Computer info & telemetry</h3>
<p>Hardware, OS, network, and runtime details streamed from the agent.</p>
<ul class="feature-list">
<li>CPU, memory, OS build, and related system signals</li>
<li>Helps verify which machine you are managing in multi-device setups</li>
<li><strong>Startup Programs Remove:</strong> Delete registry entries (<code>HKCU</code> / <code>HKLM</code>) or startup folder shortcuts directly from the dashboard; result reported as a toast notification</li>
</ul>
</div>
<div class="feature-card">
<div class="feature-icon">📜</div>
<h3>Device history</h3>
<p>See previously connected devices with names and status for faster reconnection.</p>
</div>
<div class="feature-card">
<div class="feature-icon">🔒</div>
<h3>Dashboard lock (optional)</h3>
<p>Optional password gate for the web dashboard with secure password storage on the server,
so only authorized operators can open the control panel.
</p>
<ul class="feature-list">
<li>Cookie session for the Blazor UI plus short-lived JWT for SignalR and protected APIs
</li>
<li>Lock settings include a <strong>Dashboard</strong> shortcut back to the devices view
</li>
<li>Agent file-transfer endpoints can remain callable while admin routes stay protected
</li>
</ul>
</div>
<div class="feature-card">
<div class="feature-icon">🗑️</div>
<h3>Remove agent</h3>
<p>Disconnect a device and trigger remote removal of the agent executable on the target PC.
</p>
<ul class="feature-list">
<li>Confirmation dialog before destructive actions</li>
<li>If the agent is offline, the request can be queued server-side and delivered on
reconnect</li>
</ul>
</div>
<div class="feature-card">
<div class="feature-icon">📡</div>
<h3>Real-time device ping</h3>
<p>Live round-trip latency shown for every connected agent in the device list, updated every ~10 seconds.</p>
<ul class="feature-list">
<li>Color-coded RTT indicator (green / yellow / red) for at-a-glance status</li>
<li>Cleartext ping IDs only, no sensitive payload in the probe</li>
</ul>
</div>
<div class="feature-card">
<div class="feature-icon">📲</div>
<h3>Telegram notifications & commands</h3>
<p>Optional Telegram bot integration for instant alerts and remote queries directly from your phone.</p>
<ul class="feature-list">
<li><strong>Online alert:</strong> Receive a Telegram message the moment any device comes online</li>
<li>Configure Bot Token and Chat ID from the Agent settings panel; includes BotFather setup help and a test message button</li>
<li><strong><code>/Get_info</code> command:</strong> Send the command in your Telegram chat to fetch Computer Info from an online agent; multi-device selection when several devices are connected</li>
</ul>
</div>
<div class="feature-card">
<div class="feature-icon">🕵️</div>
<h3>Stealth mode</h3>
<p>Hide the agent's tray icon so it runs silently in the background, visible only in the Windows Task Manager.</p>
<ul class="feature-list">
<li>Toggle from the Agent settings panel per device</li>
<li>No system tray icon or taskbar entry, agent keeps running uninterrupted</li>
</ul>
</div>
<div class="feature-card">
<div class="feature-icon">🛠️</div>
<h3>Server manager</h3>
<p>Desktop helper to configure ports, launch backend and frontend, and build configured
agents.</p>
<ul class="feature-list">
<li>Independent start and stop for frontend and backend services</li>
<li>Optional logging toggle and stub generation for agents</li>
<li>Aligns development <code>.env</code> and keys with your projects</li>
<li><strong>In-app Changelog:</strong> Built-in viewer for release notes and version
updates</li>
</ul>
</div>
<div class="feature-card">
<div class="feature-icon">🧅</div>
<h3>Tor Network Support</h3>
<p>Route agent traffic through the Tor anonymity network without port forwarding, using a
persistent <code>.onion</code> Hidden Service for your BackEnd.</p>
<ul class="feature-list">
<li>Enable <strong>Tor connection</strong> in Server Manager to generate and host the Hidden Service locally</li>
<li>Agent stubs embed the <code>.onion</code> address and can bundle <code>TorBundle</code> / <code>tor.exe</code></li>
<li>Agents connect via Tor SOCKS5 (Long Polling); live stream may be laggy over Tor, other features remain usable</li>
</ul>
</div>
<div class="feature-card">
<div class="feature-icon">🌐</div>
<h3>SignalR & ASP.NET Core stack</h3>
<p>Built on ASP.NET Core, Blazor Server, SignalR, SQLite, and a Windows agent.</p>
<ul class="feature-list">
<li>Real-time hub for admin and agent traffic</li>
<li>Self-hosted: you control hosting, TLS termination, and network exposure</li>
</ul>
</div>
</div><!-- /.features-carousel-track -->
<div class="features-carousel-dots" role="tablist" aria-label="Feature slides"></div>
</div><!-- /.features-carousel -->
</div>
</section>
<!-- Security Architecture Section -->
<div class="section-divider"></div>
<section id="security" class="features-section">
<div class="features-container">
<h2 class="features-title">🔐 Security Architecture</h2>
<p class="features-subtitle">Built with defence-in-depth: every layer is independently hardened</p>
<!-- Request Protection Table -->
<div class="security-block">
<h3 class="security-block-title">🛡️ Request Protection</h3>
<div class="security-table-wrap">
<table class="security-table">
<thead>
<tr><th>#</th><th>Protection</th></tr>
</thead>
<tbody>
<tr><td>1</td><td><strong>Request timeout</strong>: 30 s global, 10 min for file transfers, ∞ for SignalR (Slowloris protection)</td></tr>
<tr><td>2</td><td><strong>Security headers</strong>: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, CORP, COOP</td></tr>
<tr><td>3</td><td><strong>Request audit trail</strong>: All authentication events logged with IP, UserAgent, risk level and PII masking</td></tr>
<tr><td>4</td><td><strong>Kestrel hardening</strong>: <code>RequestHeadersTimeout: 15 s</code>, <code>KeepAliveTimeout: 120 s</code>, HTTP/2 stream limit: 100</td></tr>
<tr><td>5</td><td><strong>Login rate limiting</strong>: ASP.NET <code>AddRateLimiter</code> policy <code>login</code> (10/min/IP) on dashboard-lock verify; internal dashboard-lock check also applies</td></tr>
<tr><td>6</td><td><strong>Hub / share rate limiting</strong>: <code>hub-negotiate</code> (60/min/IP) on SignalR <code>/devicehub</code>; <code>JoinShare</code> limited via in-hub <code>ShareJoinRateLimiter</code> (20/min/IP)</td></tr>
</tbody>
</table>
</div>
</div>
<!-- Server-Level Security Table -->
<div class="security-block">
<h3 class="security-block-title">🔒 Server-Level Security</h3>
<div class="security-table-wrap">
<table class="security-table">
<thead>
<tr><th>Component</th><th>Implementation</th></tr>
</thead>
<tbody>
<tr><td><strong>Transport encryption</strong></td><td>AES-256-GCM (SignalR payload E2E), TLS via reverse proxy (Cloudflare / Nginx): <strong>HTTPS/WSS mandatory for internet deployments</strong></td></tr>
<tr><td><strong>Password storage (Dashboard Lock)</strong></td><td>ASP.NET Identity <code>IPasswordHasher</code> → PBKDF2-SHA256 with random salt; account-store encryption keys from environment / configuration (or derived from <code>AES_MASTER_KEY_HEX</code>)</td></tr>
<tr><td><strong>JWT tokens</strong></td><td>HS256 (HMAC-SHA256), configurable expiry (5-240 min), mandatory strong key in production</td></tr>
<tr><td><strong>JWT signing key</strong></td><td>Enforced minimum 32 chars; weak / default keys blocked at startup in production mode</td></tr>
<tr><td><strong>API authentication</strong></td><td>JWT Bearer with <code>DashboardAccess</code> for admin endpoints; legacy <code>/api/user/*</code> requires the same claim and is obsolete in favor of Dashboard Lock</td></tr>
<tr><td><strong>SignalR hub auth</strong></td><td><code>DashboardHubAuthorizationFilter</code>: admin methods require <code>dashboard_access: true</code>; agent methods and anonymous <code>JoinShare</code> are explicitly allow-listed</td></tr>
<tr><td><strong>AES key validation</strong></td><td>App refuses to start if <code>AES_MASTER_KEY_HEX</code> is missing or not exactly 256 bits</td></tr>
<tr><td><strong>Per-agent encryption keys</strong></td><td>Each stub built via Server Manager gets its own randomly generated AES-256 key + <code>AgentKeyId</code> registered in <code>AgentKeys.json</code> (hot-reloaded). Leaking one stub no longer exposes the traffic of every other device, the shared <code>AES_MASTER_KEY_HEX</code> remains BackEnd↔FrontEnd only</td></tr>
<tr><td><strong>Per-stub connect token</strong></td><td>Each new stub receives a unique <code>AGENT_CONNECT_TOKEN</code> (256-bit random hex). The BackEnd validates it with <code>CryptographicOperations.FixedTimeEquals</code> on <code>ConnectAsDevice</code> before registering the device, preventing identity spoofing on the open hub method</td></tr>
<tr><td><strong>Encrypted file transfer</strong></td><td>Chunked AES-256-GCM (<code>AesGcmChunkStream</code>) on agent HTTP legs; per-transfer key in encrypted SignalR metadata; <code>X-Transfer-Token</code> (HMAC); server temp files as <code>.rcenc</code> ciphertext</td></tr>
<tr><td><strong>Agent path guard</strong></td><td><code>Path.GetFullPath</code>, reject <code>..</code> segments, allowlist of logical drives + shell folders on browse/search/upload/download</td></tr>
<tr><td><strong>Encrypted hub tunnel</strong></td><td>Sensitive admin↔BackEnd and agent↔BackEnd payloads travel as AES-GCM ciphertext inside generic hub targets (<code>ReceiveEncryptedFromAdmin</code>, <code>ReceiveEncryptedFromAgent</code>, <code>ReceiveEncryptedPacket</code>), only Base64 blobs appear on the wire</td></tr>
<tr><td><strong>Replay protection</strong></td><td>In-memory <code>ReplayCache</code> tracks SHA-256 fingerprints of received ciphertext blobs. Duplicate packets are rejected immediately. Combined with a 60-second <code>packet.Timestamp</code> window, stale or replayed packets (e.g. a captured shutdown command) are silently dropped on both BackEnd and RemoteAgent sides. Configurable via <code>ReplayProtection:MaxAgeSeconds</code></td></tr>
<tr><td><strong>SQL injection</strong></td><td>Entity Framework Core parameterized queries only</td></tr>
<tr><td><strong>Error handling</strong></td><td>Internal exception details never exposed to HTTP clients; full details in server logs only</td></tr>
<tr><td><strong>Audit logging</strong></td><td>SQLite event log, action, IP, UserAgent, risk level (Low / Medium / High / Critical), PII-masked</td></tr>
<tr><td><strong>Brute force detection</strong></td><td>Automatic suspicious pattern detection (>10 failed logins or >5 rate-limit hits per hour)</td></tr>
<tr><td><strong>Timing-safe comparison</strong></td><td><code>FixedTimeEquals</code> used for admin secret and connect-token verification</td></tr>
<tr><td><strong>CORS</strong></td><td>Production requires explicit <code>Cors:AllowedOrigins</code> or <code>ALLOWED_ORIGINS</code>; wildcard <code>*</code> with credentials is rejected (fail-closed)</td></tr>
</tbody>
</table>
</div>
</div>
<!-- FrontEnd-Level Security Table -->
<div class="security-block">
<h3 class="security-block-title">🖥️ FrontEnd-Level Security</h3>
<div class="security-table-wrap">
<table class="security-table">
<thead>
<tr><th>Component</th><th>Implementation</th></tr>
</thead>
<tbody>
<tr><td><strong>Session cookie</strong></td><td><code>RemoteControl.DashboardAuth</code>, SameSite=Strict, 8 h expiry</td></tr>
<tr><td><strong>Blazor Server</strong></td><td>WebSocket-based, not vulnerable to traditional CSRF</td></tr>
<tr><td><strong>Return URL validation</strong></td><td>All <code>returnUrl</code> values validated, must start with <code>/</code>, no <code>//</code> open redirects</td></tr>
<tr><td><strong>XSS prevention</strong></td><td>Blazor DOM encoding; dashboard JS helpers escape untrusted strings before any <code>innerHTML</code> use</td></tr>
<tr><td><strong>Content Security Policy</strong></td><td>Strict CSP on all pages; no <code>unsafe-eval</code>; limited external origins</td></tr>
</tbody>
</table>
</div>
</div>
<!-- Payload Encryption Proof -->
<div class="security-block">
<h3 class="security-block-title">🔬 Payload Encryption: Live Wire Capture</h3>
<p style="color:#8b949e;font-size:0.9rem;margin-bottom:1.25rem;line-height:1.6;">
What you see in <strong style="color:#c9d1d9;">Wireshark</strong> when opening Task Manager
on a remote PC from the OffCode Web Remote Control System web dashboard; only
<code class="sec-inline-code">ReceiveEncryptedPacket</code> + encrypted Base64 on the wire.
No process names, paths, or commands in cleartext. App-layer
<strong style="color:#00ff88;">AES-256-GCM</strong> on top of TLS in production.
</p>
<div class="payload-enc-wrap">
<div class="image-card payload-enc-img-container"
data-image="PayloadEncryption.png"
data-title="Payload Encryption: Live Wire Capture"
data-desc="Wireshark capture: only ReceiveEncryptedPacket + encrypted Base64 on the wire. No process names, paths or commands in cleartext."
title="Click to view full size">
<img src="PayloadEncryption.png"
alt="Wireshark capture showing AES-256-GCM encrypted SignalR payload, no cleartext process names or commands visible"
class="payload-enc-img"
loading="lazy">
<div class="payload-enc-zoom-hint">🔍 Click to expand</div>
</div>
<div class="payload-enc-caption">
<span class="payload-enc-badge">🔒 AES-256-GCM</span>
<span class="payload-enc-badge">🛡️ TLS in production</span>
<span class="payload-enc-badge">📦 Base64-only on wire</span>
</div>
</div>
</div>
</div>
<style>
.payload-enc-wrap {
border-radius: 14px;
border: 1px solid rgba(0,255,136,0.18);
background: rgba(0,0,0,0.35);
backdrop-filter: blur(10px);
overflow: hidden;
box-shadow: 0 4px 32px rgba(0,255,136,0.06);
}
.image-card {
padding: 8px;
}
.payload-enc-img-container {
position: relative;
cursor: zoom-in;
overflow: hidden;
background: #0d1117;
text-align: center;
border-bottom: 1px solid rgba(0,255,136,0.12);
}
.payload-enc-img-container:hover .payload-enc-zoom-hint {
opacity: 1;
}
.payload-enc-zoom-hint {
position: absolute;
bottom: 0.6rem;
right: 0.75rem;
background: rgba(0,0,0,0.7);
color: #00ff88;
font-size: 0.75rem;
font-weight: 600;
padding: 0.25rem 0.65rem;
border-radius: 20px;
border: 1px solid rgba(0,255,136,0.3);
opacity: 0;
transition: opacity 0.2s ease;
pointer-events: none;
letter-spacing: 0.03em;
}
.payload-enc-img {
max-width: 100%;
width: auto;
height: auto;
display: block;
margin: 0 auto;
image-rendering: -webkit-optimize-contrast;
image-rendering: crisp-edges;
transition: transform 0.2s ease;
}
.payload-enc-img-container:hover .payload-enc-img {
transform: scale(1.01);
}
.payload-enc-caption {
display: flex;
flex-wrap: wrap;
gap: 0.6rem;
padding: 0.9rem 1.1rem;
background: rgba(0,255,136,0.04);
}
.payload-enc-badge {
font-size: 0.78rem;
font-weight: 600;
color: #00ff88;
background: rgba(0,255,136,0.1);
border: 1px solid rgba(0,255,136,0.22);
border-radius: 20px;
padding: 0.28rem 0.75rem;
letter-spacing: 0.02em;
}
.sec-inline-code {
background: rgba(0,255,136,0.1);
border-radius: 4px;
padding: 1px 5px;
font-size: 0.82rem;
color: #7ee8a2;
font-family: 'Cascadia Code', 'Consolas', monospace;
}
.security-block {
margin-bottom: 2.5rem;
}
.security-block-title {
font-size: 1.15rem;
font-weight: 700;
color: #00ff88;
margin-bottom: 0.85rem;
letter-spacing: 0.01em;
}
.security-table-wrap {
overflow-x: auto;
border-radius: 12px;
border: 1px solid rgba(0, 255, 136, 0.15);
background: rgba(255,255,255,0.025);
backdrop-filter: blur(8px);
}
.security-table {
width: 100%;
border-collapse: collapse;
font-size: 0.875rem;
color: #c9d1d9;
}
.security-table thead tr {
background: rgba(0, 255, 136, 0.07);
border-bottom: 1px solid rgba(0, 255, 136, 0.2);
}
.security-table th {
padding: 0.65rem 1rem;
text-align: left;
font-weight: 600;
color: #00ff88;
white-space: nowrap;
}
.security-table td {
padding: 0.6rem 1rem;
vertical-align: top;
border-bottom: 1px solid rgba(255,255,255,0.05);
line-height: 1.5;
}
.security-table td:first-child {
white-space: nowrap;
color: #8b949e;
}
.security-table tbody tr:last-child td {
border-bottom: none;
}
.security-table tbody tr:hover {
background: rgba(0,255,136,0.04);
}
.security-table code {
background: rgba(0,255,136,0.1);
border-radius: 4px;
padding: 1px 5px;
font-size: 0.82rem;
color: #7ee8a2;
font-family: 'Cascadia Code', 'Consolas', monospace;
overflow-wrap: anywhere;
word-break: break-word;
white-space: normal;
}
@media (max-width: 700px) {
.security-table-wrap {
overflow-x: visible;
border: none;
background: transparent;
backdrop-filter: none;
}