mrkeyoor.com_
Tue 01 Sept 17:42 UTC
Dev Toolsevaluationupdated 30 Aug 2026

sliver review

Sliver is an open-source command-and-control framework for authorized red-team and adversary-emulation work. It helps security teams create and operate test implants across Windows, macOS, and Linux so they can assess whether defenses detect realistic attacker behavior.

+17 / 2dstars / 7d
Verdict

Our build succeeded in 13 seconds, but 66 of 137 tested packages failed in the same sandbox. Sliver is a serious, unusually capable choice for experienced red teams that want cross-platform implants and several C2 transports in one open-source system. Use it only after reproducing the tests in your own controlled environment, reviewing the failures, and defining strict authorization and infrastructure boundaries.

We ran it

Install✓ · 142s0 packages
Build✓ · 13s
Tests✗ · 262s71 passed · 66 failed of 137 (go test)
Repo1670 files~247,754 lines of source · 47 MB · 8 CI workflows · Dockerfile · tests dir

Answers from our run

Does sliver build from source?

Dependencies installed in 142 seconds (0 packages), and the build succeeded in 13 seconds. We cloned commit ca685f5 into a clean Debian container with 3 CPUs and no project-specific setup.

Do sliver's tests pass?

Not all of them: 71 of 137 passed and 66 failed when we ran the project's own test command (go test). Some failures need services or credentials a bare container does not have.

Who should not use sliver?

Beginners seeking a harmless point-and-click security scanner, this is an offensive operations framework

What are the alternatives to sliver?

Metasploit Framework, Havoc, TrevorC2. Our build succeeded in 13 seconds, but 66 of 137 tested packages failed in the same sandbox.

Setup3/5Install and build passed; 66 of 137 test packages failed
Docs4/5Clear start points and a dedicated tutorial site
Community4/511,748 stars, recent push and release, but 226 open issues
Maturity4/5Broad feature set and CI, tempered by our failed test run

Discussed on

  1. hnSliver – Adversary Emulation Framework4 points

Who it’s for

Authorized red teams that need a cross-platform command-and-control framework
Security consultancies running controlled adversary-emulation engagements
Blue teams building detections against mTLS, WireGuard, HTTP(S), or DNS command traffic
Experienced operators who can isolate infrastructure and review payload behavior

Who it’s NOT for

Beginners seeking a harmless point-and-click security scanner, this is an offensive operations framework
Teams without written authorization and tightly defined testing scope
Buyers who require a fully passing test suite in a plain Go container
Organizations unwilling to assess GPL-3.0 obligations or secure their own C2 infrastructure

Setup reality

Our run installed successfully in 142 seconds with 0 packages installed, then built successfully in 13 seconds, but the test step failed after 262 seconds: 71 packages passed and 66 failed out of 137. The README makes the first launch look simple through a release download or a curl-to-sudo shell command, and the clean build supports that impression, but our test result means a careful team should budget time to inspect the full failures and validate its intended workflows before treating setup as complete. The visible tail showed several passing packages followed only by the final FAIL marker, so it does not establish a cause.

Sliver is an operator framework, not a security scanner

Sliver sits in the command-and-control layer of an authorized adversary-emulation exercise. An operator runs its server and client, creates implants, and tests whether an organization can observe attacker-like activity. Unlike a vulnerability scanner, it is built for controlled post-compromise operations and requires written permission, isolated infrastructure, and skilled operators.

The project supports server and client operation on macOS, Windows, and Linux, while its implants target those same 3 operating-system families. Its README says other Go compiler targets may work but have not all been tested. With 11,748 GitHub stars, this is not an obscure experiment, yet popularity cannot replace an internal safety and legal review.

Our run built cleanly, but the tests did not pass

We cloned commit ca685f5 into an unprivileged Debian container with 3 CPUs and 8 GB of RAM, using golang:1.24-bookworm and no secrets. The checkout contained 1,670 files, about 247,754 lines of source, and occupied 47 MB. This is a substantial system, not a small utility understood from one executable.

In our run, installation succeeded in 142 seconds and installed 0 packages. The build then succeeded in 13 seconds. That is encouraging for reproducibility in a clean Go environment, but it does not validate server configuration, transport behavior, generated implants, or a real engagement workflow.

The test command failed after 262 seconds. Of 137 tested packages, 71 passed and 66 failed. The last visible lines show successful results for several end-to-end, reporting, utility, encoder, and minisign packages, followed by a final FAIL marker. They omit the earlier failure messages, so assigning a cause would be guesswork. Teams should inspect the complete log and reproduce the command before adoption.

The repository includes 8 CI workflow files, a Dockerfile, and a tests directory. They show that automated validation exists, but they do not erase our measured outcome. A security team should make a passing, documented validation run part of its acceptance gate because a command-and-control framework carries serious operational risk.

Multiple transports and generated implants are the main strengths

Sliver's clearest advantage is breadth within one operator environment. The README lists command-and-control over mutual TLS, WireGuard, HTTP(S), and DNS, with dynamically compiled implants that receive per-binary asymmetric encryption keys. It also supports staged and stageless payloads, compile-time obfuscation, multiplayer operation, and procedural HTTP(S) command-and-control. This lets a red team model several traffic and delivery constraints without separate frameworks.

Post-exploitation capabilities include Windows process migration and injection, user-token manipulation, in-memory .NET assembly execution, a COFF/BOF in-memory loader, and pivots over TCP or named pipes. A DNS canary is framed as a blue-team detection aid, while Let's Encrypt integration can simplify certificate handling. Python scripting through sliver-py can support repeatable exercises, though teams should assess that separate project independently.

Cross-platform support is another practical strength. The server and client run on all 3 named desktop operating systems, enabling mixed operator fleets, while Go-based compilation supports the implant workflow. Consultancies can reduce tool switching, and internal teams can standardize purple-team exercises across Windows, Linux, and macOS endpoints.

The rough edges demand experienced operators

The README's Linux one-liner pipes a remote install script into sudo. Security teams should download, inspect, and pin installation material instead of granting a network response immediate root execution. The release download and documented source-compilation path are better starting points for supply-chain review. GPL-3.0 licensing also deserves review before modification or redistribution.

Operational complexity is the larger cost. Four C2 transport choices, generated payloads, multiplayer support, pivots, certificates, and in-memory execution create many configuration and containment decisions. The 226 open issues indicate a meaningful support and triage surface. That count does not prove poor maintenance, but buyers should search for issues matching their platform and transport.

Current activity is strong, with an issue backlog to inspect

The repository was pushed on August 30, 2026, the same date as our review, and release v1.7.6 arrived on August 28, 2026. Together, those are strong signs of active maintenance. The community snapshot also recorded 6 additional stars that day. This cannot show response quality, but it argues against treating the project as dormant.

At 11,748 stars and 226 open issues, Sliver has substantial adoption and visible maintenance pressure. Inspect recent bug discussions for the exact operating systems, payload modes, and C2 transports you intend to use. A production decision should depend on useful maintainer responses and a tested upgrade and rollback path.

It belongs in an isolated red-team stack

Sliver should sit behind dedicated operator access controls, segmented from ordinary corporate services, with engagement-specific certificates, domains, credentials, and logs. Pair it with authorization records, endpoint and network telemetry, and a cleanup checklist. The blue team should correlate generated behavior with endpoint, DNS, proxy, and firewall evidence after an agreed test window.

For experienced, authorized teams, the combination of 4 named C2 transports, cross-platform implants, scripting, pivots, and in-memory execution makes Sliver a compelling open-source center of gravity. Newcomers should start in a disposable lab with supervision. The project looks active and capable, but each team must prove readiness on its own infrastructure.

Alternatives

ProjectWhat it isPick it when
Metasploit FrameworkA broad exploitation and post-exploitation framework with a large module catalog.Pick this instead when exploit breadth, established modules, and training resources matter more than Sliver's implant-focused workflow.
HavocAn open-source command-and-control framework aimed at red-team operations.Pick this instead when you prefer Havoc's operator model and have validated its features and maintenance against your engagement needs.
TrevorC2A smaller command-and-control framework designed around covert HTTP communication.Pick this instead when a narrower HTTP-focused tool is easier to audit and sufficient for the exercise.

What people are saying

  1. [github-trending] BishopFox/sliver

Sources

  1. BishopFox/sliver on GitHub
  2. Sliver documentation
  3. Sliver releases

More dev tools reviews

workmux · v2rayNG · SecLists · hashcat · eslint · fastfetch · the whole board →