BishopFox/sliver

What it is

Sliver is an open-source adversary emulation and red team framework for authorized security testing, maintained by BishopFox. It is a command-and-control (C2) system for managing implants on macOS, Windows, and Linux targets.

The distinguishing design choice is per-binary customization: implants are compiled dynamically with unique asymmetric encryption keys for each binary, rather than sharing a single static payload. C2 traffic can travel over Mutual TLS, WireGuard, HTTP(S), or DNS. The framework supports native and shellcode payloads, userspace reflective loading, built-in shellcode encoding, and BOF/COFF execution on amd64 and arm64.

It fits red teams, penetration testers, and security organizations that need a controllable C2 platform and are working under explicit authorization.

Getting started

The documented path is to download the latest release from the Sliver releases page, then follow the Getting Started guide for server and client setup.

On Linux, the README also offers a one-line installer:

curl https://sliver.sh/install | sudo bash

After installation, launch the client with:

sliver

That command starts the client; the Getting Started guide covers the server configuration and basic operator workflow. For the newest code, the project points to compiling from source.

Constraints

Sliver is intended only for authorized security testing; it is a dual-use C2 framework, and operating it outside a sanctioned engagement is not a legitimate use. Both server and client run on macOS, Windows, and Linux. Implants officially support the same three platforms and may run on other targets the Go compiler supports, but those configurations are not regularly tested. The project is licensed under GPLv3, with some sub-components carrying separate licenses documented in their subdirectories.

HotRepo's take

On the Go daily list for 2026-11-09, Sliver recorded 16 new stars and reached 16th place. With no long-term snapshot series available, that single day is not enough to characterize a trend. What stands out is the scale of a mature dual-use security project — roughly 12.3k stars and 1.7k forks — and its scope: four C2 transports, dynamic per-implant compilation, and BOF support across amd64 and arm64. The Go-based server and client also mean the tooling is buildable and inspectable from source rather than distributed only as binaries.