> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/c2-framworks/05-introduction-to-sliver-c2.md).

# 05 — Introduction to Sliver C2

<figure><img src="/files/jzVwdJ4ToftDzGI15H2Y" alt=""><figcaption></figcaption></figure>

### 5.1 What is Sliver?

**Sliver** is a free, open-source, cross-platform C2 framework built by Bishop Fox in Go, designed as an open alternative to commercial frameworks like Cobalt Strike. It's widely used in professional red team engagements and adversary emulation.

* GitHub: `github.com/BishopFox/sliver`
* Docs/site: `sliver.sh`

### 5.2 Key Features

* **Cross-platform implants** — compiles natively for Windows, Linux, and macOS, across many architectures.
* **Multiplayer mode** — multiple operators can connect to one team server simultaneously with mTLS-authenticated client configs, useful for larger engagements.
* **Four C2 transports** — mTLS, HTTP(S), DNS, and WireGuard.
* **Per-binary unique encryption keys** — each implant is dynamically compiled with its own asymmetric keypair, reducing the value of any single leaked/reversed sample.
* **Sessions and Beacons** — supports both interactive and asynchronous operation modes (see `03-c2-concepts-and-types.md` for the distinction).
* **Extensibility** — supports Beacon Object Files (BOFs), extensions, and the **Armory**, a package manager for community-built extensions/aliases.
* **In-memory execution** primitives for post-exploitation tooling.

### 5.3 How Sliver Maps to the Generic C2 Model

| Generic C2 concept (from `02-c2-basics.md`) | Sliver term                            |
| ------------------------------------------- | -------------------------------------- |
| Team Server                                 | `sliver-server`                        |
| Operator Console                            | `sliver-client`                        |
| Listener                                    | `mtls` / `http(s)` / `dns` / `wg` jobs |
| Implant                                     | Generated binary (session or beacon)   |

### 5.4 Diagram — Sliver Architecture

```mermaid
flowchart TB
    subgraph Operators
      O1["Operator Console 1"]
      O2["Operator Console 2"]
    end
    O1 <--mTLS auth--> Server["Sliver Server (Team Server)"]
    O2 <--mTLS auth--> Server
    Server --> LmTLS["mTLS Listener"]
    Server --> LHTTP["HTTP(S) Listener"]
    Server --> LDNS["DNS Listener"]
    Server --> LWG["WireGuard Listener"]
    LmTLS <--> Beacon1["Beacon (async check-in)"]
    LHTTP <--> Session1["Session (interactive)"]
```

### 5.5 Sessions vs. Beacons — Sliver Specifics

Same concept as `03-c2-concepts-and-types.md`, applied in Sliver:

* `generate` → produces a **session** implant by default.
* `generate beacon` → produces a **beacon** implant, with `--seconds` (sleep) and `--jitter` flags.

### 5.6 What's Next

`06-sliver-installation-setup.md` walks through installing the server, setting up multiplayer, and building your isolated lab network.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/c2-framworks/05-introduction-to-sliver-c2.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.