c2-sliver
Sliver C2 framework operations — server connection, listener setup, implant generation, BOF/Armory extensions, post-implant operations, HTTP C2 profiles.
Best for Red team operationsWorks with GitHubHigh risk
⌘source
- author
@PurpleAILAB- language
- Python
★2.1kstars
366forks
Apr 18, 2026
✦overview.md
Key Features
- ·Open-source cross-platform adversary emulation framework
- ·Supports beacon (async) and session (interactive) implants
- ·Communicates over mTLS, HTTPS, DNS, and WireGuard channels
- ·Multi-operator support for collaborative operations
- ·Includes BOF/Armory extensions for expanded capabilities
- ·Automated server setup and client configuration in sandbox
Use Cases
- →Establishing command-and-control infrastructure for security testing
- →Generating and deploying implants to target systems
- →Setting up listeners for various communication protocols
- →Managing post-implant operations and beacon communications
- →Utilizing BOF/Armory extensions for specialized attack techniques
Best for
- ✓Red team operations
- ✓Adversary emulation exercises
- ✓Security testing environments
Not ideal for
- !Production environments
- !Unauthorized security testing
- !General-purpose system administration
FAQs
name
c2-sliver
description
Sliver C2 framework operations — server connection, listener setup, implant generation, BOF/Armory extensions, post-implant operations, HTTP C2 profiles.
allowed-tools:Bash Read
metadata:{"subdomain":"command-and-control","when_to_use":"Sliver, sliver-client, sliver listener, sliver implant, sliver beacon, armory, BOF","tags":"c2, sliver, implant, beacon, listener, bof, armory, pivot","mitre_attack":"T1071, T1573, T1090, T1105, T1572"}
Sliver C2 Framework
Sliver is an open-source, cross-platform adversary emulation framework by BishopFox. It supports beacon (async) and session (interactive) implants over mTLS, HTTPS, DNS, and WireGuard channels with multi-operator support.
Decepticon Setup
Server:
c2-slivercontainer onsandbox-net(daemon mode, gRPC on port 31337) Client:sliver-clientpre-installed in sandbox Config: Auto-generated operator config at/workspace/.sliver-configs/decepticon.cfgConnection Procedure (via bash tool)
# 1. Verify C2 reachable bash(command="nc -z c2-sliver 31337 && echo 'C2_OK' || echo 'C2_DOWN'") # 2. Import operator config (once — skip if already imported) bash(command="ls ~/.sliver-client/configs/ 2>/dev/null | grep -q . || sliver-client import /workspace/.sliver-configs/decepticon.cfg") # 3. Start interactive console in dedicated tmux session bash(command="sliver-client console", session="c2") # 4. Run Sliver commands interactively bash(command="https --lhost 0.0.0.0 --lport 443 --domain c2-sliver", is_input=True, session="c2") bash(command="sessions", is_input=True, session="c2")IMPORTANT:
$install
1-click copynpx skills add PurpleAILAB/Decepticon --skill c2-sliverSafety assessment
★
Clarity score
How clear and easy to understand the SKILL.md instructions are, rated from 1 to 5.
4/ 5
very goodClear and well structured, with only minor parts that might need a second read.
◎
Actionability score
How directly an agent can act on the SKILL.md instructions, rated from 1 to 5.
4/ 5
highMostly actionable with clear steps; only a few small gaps remain.