Command and control servers, or C&C servers, have a negative perception due to their extensive use for malicious purposes, such as delivering malware or other malicious payloads. For the same reasons they are used in a negative manner, they can also be used in a positive way. These C&C servers serve as the perfect way to get the data or evidence you are collecting to an offsite server so that you can review, arrange, and finalize it. You never want to leave any evidence that you were on a particular system or even leave any files or findings behind. This is where C&C servers come into play, as they can be a single source for all your penetration-testing evidence.
Where your C&C server resides is really up to you. Most of the time, C&C servers reside in someone's cloud. This could be within AWS, Azure, or any other cloud flavor...
