Sliver is an open-source, cross-platform adversary emulation and red team framework written in Go, used by security teams of all sizes to perform authorized security testing with implants that support command-and-control over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS.

What it is

Sliver is an adversary emulation and red team framework maintained under the BishopFox organization on GitHub. It is written in Go, licensed under GPLv3, and sits in the Infrastructure & Operations / Networking & Connectivity category of this registry. The project provides both a server and a client that run on MacOS, Windows, and Linux, alongside implants that target the same three platforms and, by extension, other Go compiler targets the maintainers have not tested. Its topics place it squarely in the command-and-control (C2) and red-team-engagement space, and documentation and tutorials live at sliver.sh.

The concrete problem it solves is giving operators a single, self-hosted platform for generating, deploying, and controlling implants during an engagement instead of stitching together separate closed tooling. Implants are dynamically compiled with per-binary asymmetric encryption keys, and the framework covers secure C2 over mTLS, WireGuard, HTTP(S), and DNS, procedurally generated HTTPS C2, and a DNS canary for blue team detection. The facts provided do not name a specific commercial product it replaces, so it stands here as an open-source framework for the C2 layer of adversary simulation work.

Key capabilities

• Command-and-control over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS, with transport encryption documented at sliver.sh.
• Procedurally generated C2 over HTTP(S) and a DNS canary for blue team detection.
• Dynamic code generation and compile-time obfuscation, with both staged and stageless payloads.
• Multiplayer mode for teams of operators working a single engagement.
• Windows tradecraft including process migration, process injection, and user token manipulation.
• In-memory .NET assembly execution and a COFF/BOF in-memory loader, plus TCP and named pipe pivots.
• Fully scriptable through the Python client sliver-py, with Let's Encrypt integration for certificates.

Who uses it and how

• Red teams running red-team engagements use it as their C2 framework, deploying a Sliver server and connecting the client from MacOS, Windows, or Linux.
• Adversary simulation teams compile per-target implants and route them over mTLS, WireGuard, HTTP(S), or DNS depending on the network they must traverse.
• Blue teams use the DNS canary feature to detect implant traffic during exercises.
• Multiplayer mode lets several operators share one server during a large engagement.
• Python-driven workflows use sliver-py to automate implant generation and tasking.

Getting started

Download the latest release from GitHub, or on Linux run the one-liner curl https://sliver.sh/install|sudo bash and then start the sliver client. The Sliver wiki at sliver.sh covers basic setup and usage.

How it compares

The facts provided name no paid products this project replaces and no comparable tools in the same space. On that basis, Sliver stands alone in this registry, with its position defined by the open-source GPLv3 licence and its self-hosted server and client model rather than by a named commercial alternative.

When to use it — and when not to

Sliver is a dual-use offensive security tool, so it belongs only in authorized security testing, and anyone unwilling to run and secure their own Sliver server and manage transport encryption should look elsewhere. Operators must accept that the project is licensed GPLv3 while some sub-components carry separate licences, which warrants a licence review before adoption in a commercial setting, and the repository currently shows 222 open issues. Teams without the skills to operate a C2 infrastructure and its certificates should not pick it up.