Red Teaming with the Sliver Framework
The Sliver Toolkit for Red Teaming Assessments is a toolkit designed to help security professionals around the world review their network protection.
What Is the Sliver Tool for Red Teaming Assessments?
The Sliver Toolkit is an open-source framework for penetration testing and red teaming assessments, designed to help security professionals worldwide validate their network defenses. With Sliver, users can run targeted tests to identify and remediate vulnerabilities in their networks, as well as simulate known attack techniques to uncover gaps in existing security measures. Comprehensive documentation makes it easy to get started and helps teams systematically reduce risk across their IT infrastructure.
Sliver vs Cobalt Strike
Cobalt Strike is a commercial command-and-control framework used in compromised networks to facilitate lateral movement after an initial breach. Compared to Cobalt Strike, Sliver offers a significantly larger set of built-in modules, making it easier to exploit systems and gain access. As security analysts have continuously improved their detection and countermeasures against Cobalt Strike, threat actors have increasingly sought alternatives. Sliver is a free, open-source project available on GitHub -- unlike Cobalt Strike, whose commercial licensing must be circumvented with each new release. As a result, Sliver has gained significant traction as a legitimate C2 framework and an open-source alternative to both Cobalt Strike and Metasploit.
Sliver's Features
-
Dynamic Code Generation: Implants are uniquely generated each time, making signature-based detection significantly harder.
-
Compile-Time Obfuscation: Source code is obfuscated at compile time, reducing the effectiveness of static analysis.
-
Multiplayer Mode: Multiple operators can work on the same assessment simultaneously, coordinating through a shared server.
-
Staged and Stageless Payloads: Payloads can be delivered in multiple stages (staged) or as a single file (stageless), depending on the scenario.
-
Procedurally Generated C2 over HTTP(S): C2 communication over HTTP(S) is dynamically generated to blend in with normal network traffic.
-
DNS Canary Blue Team Detection: Sliver detects DNS canary records placed by blue teams and alerts the operator accordingly.
-
Secure C2 over mTLS, WireGuard, HTTP(S), and DNS: Multiple encrypted protocols are available for the connection between implant and C2 server.
-
Fully Scriptable with JavaScript/TypeScript or Python: All workflows can be automated via scripts, making complex attack scenarios reproducible.
-
Windows Process Migration, Process Injection, and Token Manipulation: Advanced post-exploitation techniques on Windows allow migrating between processes, injecting code, and manipulating user tokens.
-
Let's Encrypt Integration: TLS certificates can be obtained automatically via Let's Encrypt to secure C2 communications.
-
In-Memory .NET Assembly Execution: .NET assemblies are executed directly in memory without writing files to disk.
-
COFF/BOF In-Memory Loader: COFF and BOF files (Beacon Object Files) can be loaded and executed in memory.
-
TCP and Named Pipe Pivots: TCP and named pipe connections enable pivoting to additional systems within the network.
Conclusion
The Sliver Framework is a powerful open-source C2 framework that offers red teams and penetration testers a flexible alternative to commercial solutions like Cobalt Strike. With features such as dynamic code generation, compile-time obfuscation, and secure communication via mTLS, WireGuard, HTTP(S), and DNS, Sliver provides a comprehensive platform for realistic attack simulations. Its open-source nature and active development make it an increasingly popular choice for security assessments and red teaming engagements.