What is this?
Sliver is an open source cross-platform adversary emulation and red team framework that organizations of any size can use to perform security testing.
Sliver is an open source cross-platform adversary emulation and red team framework that organizations of any size can use to perform security testing.Is this a tool I run locally, or a server I have to deploy?It is a client-server framework: you run a Sliver server, control it from a client console, and generate implant binaries that execute on target machines and call back to you.
It is a client-server framework: you run a Sliver server, control it from a client console, and generate implant binaries that execute on target machines and call back to you.How do I get it running?Download the latest release and follow the wiki's quick setup tutorial, then start the 'sliver' console. Linux has a one-line install script, and you can compile from source for the very latest code.
Download the latest release and follow the wiki's quick setup tutorial, then start the 'sliver' console. Linux has a one-line install script, and you can compile from source for the very latest code.Do I need anything installed before I start?No extra setup for everyday use — you download a ready-made release binary. Only building the newest code from source requires the Go toolchain, since Sliver is written in Go.
No extra setup for everyday use — you download a ready-made release binary. Only building the newest code from source requires the Go toolchain, since Sliver is written in Go.Are there platforms it can't cover?Beyond the big three desktop OSes, implant support is not guaranteed — implants may work on any Golang compiler target, but the authors note they have not tested them all.
Beyond the big three desktop OSes, implant support is not guaranteed — implants may work on any Golang compiler target, but the authors note they have not tested them all.Will it run on my machine, or is it Linux-only like a lot of red team tooling?Server, client, and implants all run on macOS, Windows, and Linux, so the same framework covers both the operator box and the target.
Server, client, and implants all run on macOS, Windows, and Linux, so the same framework covers both the operator box and the target.What does it cost, and is the license restrictive?It is free and licensed under GPLv3. Note that some sub-components may carry separate licenses, detailed in their respective subdirectories.
It is free and licensed under GPLv3. Note that some sub-components may carry separate licenses, detailed in their respective subdirectories.How do the implants communicate back to the server?Over Mutual TLS (mTLS), WireGuard, HTTP(S), or DNS, and each implant is dynamically compiled with its own asymmetric encryption keys. The HTTP(S) C2 can even be procedurally generated per deployment.
Over Mutual TLS (mTLS), WireGuard, HTTP(S), or DNS, and each implant is dynamically compiled with its own asymmetric encryption keys. The HTTP(S) C2 can even be procedurally generated per deployment.What can it actually do on a machine once an implant is running?Post-exploitation staples: on Windows it supports process migration, process injection, and user token manipulation. It can also execute in-memory .NET assemblies, load COFF/BOFs in memory, and pivot through a target over TCP or named pipes.
Post-exploitation staples: on Windows it supports process migration, process injection, and user token manipulation. It can also execute in-memory .NET assemblies, load COFF/BOFs in memory, and pivot through a target over TCP or named pipes.Can several operators share one server at once?Yes — multiplayer mode is built in, so a team can work off a single Sliver server. Sessions are also fully scriptable with Python if you want to automate your workflows.
Yes — multiplayer mode is built in, so a team can work off a single Sliver server. Sessions are also fully scriptable with Python if you want to automate your workflows.How does it try to stay ahead of blue teams?Dynamic code generation and compile-time obfuscation make every implant build unique, and DNS canaries detect when defenders are hunting your C2. A Let's Encrypt integration helps HTTPS channels blend into normal traffic.
Dynamic code generation and compile-time obfuscation make every implant build unique, and DNS canaries detect when defenders are hunting your C2. A Let's Encrypt integration helps HTTPS channels blend into normal traffic.What are similar projects?redStackPRO, BEAR-C2, Decepticon, evilginx2, smartdns, XSStrike, Red-Teaming-Toolkit, Cybermes
redStackPRO, BEAR-C2, Decepticon, evilginx2, smartdns, XSStrike, Red-Teaming-Toolkit, CybermesWhich topics is it in?adversarial-attacks, command-and-control, dns-server, red-teaming, wireguard, scripting, offensive-security, red-team, dns, pentesting, tls, penetration-testing
adversarial-attacks, command-and-control, dns-server, red-teaming, wireguard, scripting, offensive-security, red-team, dns, pentesting, tls, penetration-testing