feat(backend): default verify_tls to false for lab/redteam Mythic

flip default to False at model, API fallback, adapter, and factory layers.
add migration 0008 flipping c2_config.verify_tls server_default to false.
suppress urllib3 InsecureRequestWarning when verify_tls is off.
adapt c2 tests to new verify_tls default.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/api/c2.py

@@ -84,7 +84,7 @@ def upsert_c2_config(eid: int):
     if not parsed.hostname:
         return jsonify({"error": "url must contain a hostname"}), 400
 
-    verify_tls = data.get("verify_tls", True)
+    verify_tls = data.get("verify_tls", False)
     if not isinstance(verify_tls, bool):
         return jsonify({"error": "verify_tls must be a boolean"}), 400
 

backend/app/models/c2_config.py

@@ -19,7 +19,7 @@ class C2Config(db.Model):  # type: ignore[name-defined]
     )
     url = db.Column(db.Text, nullable=False)
     api_token_encrypted = db.Column(db.Text, nullable=False)
-    verify_tls = db.Column(db.Boolean, nullable=False, default=True)
+    verify_tls = db.Column(db.Boolean, nullable=False, default=False)
     created_at = db.Column(
         db.DateTime, nullable=False, default=lambda: datetime.now(UTC)
     )

backend/app/services/c2/factory.py

@@ -6,7 +6,7 @@ import os
 from backend.app.services.c2.adapter import C2Adapter
 
 
-def get_adapter(url: str, api_token: str, verify_tls: bool = True) -> C2Adapter:
+def get_adapter(url: str, api_token: str, verify_tls: bool = False) -> C2Adapter:
     """Return the correct C2Adapter based on MIMIC_C2_ADAPTER (default: mythic)."""
     adapter_name = os.environ.get("MIMIC_C2_ADAPTER", "mythic").lower()
 

backend/app/services/c2/mythic.py

@@ -15,6 +15,8 @@ from __future__ import annotations
 from datetime import datetime
 
 import requests
+import urllib3
+from urllib3.exceptions import InsecureRequestWarning
 
 from backend.app.services.c2.adapter import (
     C2Adapter,
@@ -113,10 +115,14 @@ query GetTaskOutput($display_id: Int!) {
 class MythicAdapter(C2Adapter):
     """Real Mythic 3.x adapter using GraphQL over HTTP."""
 
-    def __init__(self, url: str, api_token: str, verify_tls: bool = True) -> None:
+    def __init__(self, url: str, api_token: str, verify_tls: bool = False) -> None:
         self._url = url.rstrip("/") + "/graphql"
         self._token = api_token
         self._verify = verify_tls
+        if not verify_tls:
+            # Lab/red-team Mythic instances commonly use self-signed certs.
+            # Suppress urllib3 warnings once per process when verification is off.
+            urllib3.disable_warnings(InsecureRequestWarning)
 
     def _headers(self) -> dict[str, str]:
         return {