BishopFox/sliver

Features

• Command and Control Platforms - Provides a centralized command and control platform for managing remote systems and coordinating multi-operator security engagements.
• Execution Engines - Run binary files and code assemblies directly in system memory to perform post-exploitation tasks without writing any files to the local disk.
• Post-Exploitation Frameworks - Provides a comprehensive framework for executing post-exploitation tasks and gathering system information on remote targets.
• Adversary Emulation Frameworks - Provides a comprehensive platform for conducting adversary emulation and security assessments through coordinated remote system management.
• Command and Control Frameworks - Coordinates multi-operator sessions and manages secure communication channels as a centralized command and control framework.
• Secure Communication Protocols - Maintains encrypted command channels using standard protocols like mTLS, WireGuard, HTTP, and DNS for private data transmission.
• Post-Exploitation Tools - Executes post-exploitation tasks, manages system processes, and performs network pivoting to assess security controls after initial access.
• Mutual TLS Authentication - Uses mutual TLS certificate-based authentication to establish secure and verified communication tunnels between the controller and remote systems.
• Payload Development Tools - Supports the development of custom, obfuscated binaries designed to test the detection capabilities of endpoint security solutions.
• Executable Obfuscators - Generates unique, obfuscated binaries during the build process to evade signature-based detection by security software.
• Secure Remote Access - Establishes encrypted remote connections between the controller and target systems to ensure reliable and covert command execution.
• Adversarial Testing Resources - Simulates realistic cyber attacks to evaluate the effectiveness of organizational security controls and incident response procedures.
• Communication Servers - Maintains private and reliable communication with compromised systems using mTLS, WireGuard, and DNS protocols.
• Memory-Only Execution - Supports in-memory execution of payloads to minimize disk artifacts and evade forensic detection.
• Security Payload Generators - Automates the creation and obfuscation of custom binaries to support staged and stageless execution patterns during security assessments.
• Command and Control - Cross-platform implant framework supporting multiple protocols.
• Command And Control Frameworks - General-purpose implant framework supporting multiple communication protocols.
• Tunneling and Proxying - Cross-platform adversary simulation and red team framework.
• Network Traffic Routing - Routes traffic through compromised hosts using TCP or named pipes to reach isolated network segments.
• Network Tunnels - Routes traffic through compromised internal hosts to expand access and reach isolated network segments during security assessments.
• Security Token Manipulators - Enables process manipulation, token management, and session migration to maintain persistent access and escalate privileges.
• Session Coordination - Synchronizes state across a centralized server to enable multiple operators to coordinate and interact with sessions simultaneously.
• Security Assessment Frameworks - Provides a centralized interface for automating complex security workflows and repetitive testing procedures.
• Asynchronous Task Queues - Implements an asynchronous task queue to ensure reliable command delivery between the controller and remote targets despite intermittent network connectivity.

Star history