Welcome to Better-Sliver, a fork of the Sliver project. This fork is intended to be a community-driven effort to improve the Sliver project. The goal is to make Sliver less detectable by adding more features, changing default fingerprints, and adding more obfuscation options. This fork is not intended to be a replacement for Sliver, but rather a place to experiment with new ideas and features. If you have an idea for a feature, please open an issue or a pull request.
There are current issues with the sleepmask feature. Sleepmask is not likely to happen due to go routines
- Git clone this repo
- Run make
It's that simple!
- Stopped go-donut from trying to bypass AMSI by default
- Broke all static shellcode signatures for current version of Sliver. The only one left is a Donut signature that can be easily bypassed.
- Changed the default mTLS server and implant CAs for different fingerprints
- Changed the shell command, throwing off yara detections
- Implemented JARM randomization (This has also now been added to Sliver v1.6 in dev)
- Added some sleepmasking to the beacons (had to remove this due to big bugs)
Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS and are dynamically compiled with per-binary asymmetric encryption keys.
The server and client support MacOS, Windows, and Linux. Implants are supported on MacOS, Windows, and Linux (and possibly every Golang compiler target but we've not tested them all).
NOTE: You are looking the latest master branch of Sliver v1.6.0; new PRs should target this branch. However, this branch is NOT RECOMMENDED for production use yet. Please use release tagged versions for the best experience.
For PRs containing bug fixes specific to Sliver v1.5, please target the v1.5.x/master branch.
- Dynamic code generation
- Compile-time obfuscation
- Multiplayer-mode
- Staged and Stageless payloads
- Procedurally generated C2 over HTTP(S)
- DNS canary blue team detection
- Secure C2 over mTLS, WireGuard, HTTP(S), and DNS
- Fully scriptable using JavaScript/TypeScript or Python
- Windows process migration, process injection, user token manipulation, etc.
- Let's Encrypt integration
- In-memory .NET assembly execution
- COFF/BOF in-memory loader
- TCP and named pipe pivots
- Much more!
Download the latest release and see the Sliver wiki for a quick tutorial on basic setup and usage. To get the very latest and greatest compile from source.
curl https://sliver.sh/install|sudo bash and then run sliver
Please checkout the wiki, or start a GitHub discussion. We also tend to hang out in the #golang Slack channel on the Bloodhound Gang server.
See the wiki.
Please take a moment and fill out our survey
Sliver is licensed under GPLv3, some sub-components may have separate licenses. See their respective subdirectories in this project for details.