BishopFox/sliver
Sliver
Sliver is a command and control framework designed for adversary emulation and security assessment operations. It provides a centralized platform for managing remote systems, enabling security professionals to coordinate multi-operator sessions and maintain persistent, secure communication channels across diverse network environments.
The framework distinguishes itself through its focus on stealth and infrastructure flexibility. It utilizes dynamic payload obfuscation to generate unique binaries and supports in-memory execution to minimize disk artifacts. Communication is secured through mutual TLS, WireGuard, and other standard protocols, while an asynchronous task queue ensures reliable command delivery even across intermittent network connections.
Beyond its core communication capabilities, the platform supports a wide range of post-exploitation tasks, including process manipulation, token management, and network pivoting. Users can automate complex security workflows and route traffic through compromised nodes to reach isolated network segments, facilitating comprehensive testing of organizational security controls.
Features
- Command and Control Platforms - Provides a centralized command and control platform for managing remote systems and coordinating multi-operator security engagements.
- Execution Engines - Run binary files and code assemblies directly in system memory to perform post-exploitation tasks without writing any files to the local disk.
- Post-Exploitation Frameworks - Provides a comprehensive framework for executing post-exploitation tasks and gathering system information on remote targets.
- Adversary Emulation Frameworks - Provides a comprehensive platform for conducting adversary emulation and security assessments through coordinated remote system management.
- Command and Control Frameworks - Coordinates multi-operator sessions and manages secure communication channels as a centralized command and control framework.
- Secure Communication Protocols - Maintains encrypted command channels using standard protocols like mTLS, WireGuard, HTTP, and DNS for private data transmission.
- Post-Exploitation Tools - Executes post-exploitation tasks, manages system processes, and performs network pivoting to assess security controls after initial access.
- Mutual TLS Authentication - Uses mutual TLS certificate-based authentication to establish secure and verified communication tunnels between the controller and remote systems.
- Payload Development Tools - Supports the development of custom, obfuscated binaries designed to test the detection capabilities of endpoint security solutions.
- Executable Obfuscators - Generates unique, obfuscated binaries during the build process to evade signature-based detection by security software.
- Secure Remote Access - Establishes encrypted remote connections between the controller and target systems to ensure reliable and covert command execution.
- Adversarial Testing Resources - Simulates realistic cyber attacks to evaluate the effectiveness of organizational security controls and incident response procedures.
- Communication Servers - Maintains private and reliable communication with compromised systems using mTLS, WireGuard, and DNS protocols.
- Memory-Only Execution - Supports in-memory execution of payloads to minimize disk artifacts and evade forensic detection.
- Security Payload Generators - Automates the creation and obfuscation of custom binaries to support staged and stageless execution patterns during security assessments.
- Command and Control - Cross-platform implant framework supporting multiple protocols.
- Command and Control - Implant framework for red team operations.
- Command And Control Frameworks - General-purpose implant framework supporting multiple communication protocols.
- Exploitation Frameworks - Cross-platform framework for adversary emulation and red teaming.
- Tunneling and Proxying - Cross-platform adversary simulation and red team framework.
- Vulnerability Scanning and Auditing - Cross-platform adversary emulation and red team framework.
- Network Traffic Routing - Routes traffic through compromised hosts using TCP or named pipes to reach isolated network segments.
- Network Tunnels - Routes traffic through compromised internal hosts to expand access and reach isolated network segments during security assessments.
- Security Token Manipulators - Enables process manipulation, token management, and session migration to maintain persistent access and escalate privileges.
- Session Coordination - Synchronizes state across a centralized server to enable multiple operators to coordinate and interact with sessions simultaneously.
- Security Assessment Frameworks - Provides a centralized interface for automating complex security workflows and repetitive testing procedures.
- Asynchronous Task Queues - Implements an asynchronous task queue to ensure reliable command delivery between the controller and remote targets despite intermittent network connectivity.
