https://cybertoolchain.io/tools/sliver New releases and features in sliver, tracked by The Cyber Toolchain. en Sat, 03 Oct 2026 19:08:40 GMT https://github.com/BishopFox/sliver/releases/tag/v1.7.8 https://github.com/BishopFox/sliver/releases/tag/v1.7.8 Sat, 03 Oct 2026 19:08:40 GMT Sliver v1.7.8 adds --service-name for Windows service implants, a real-time crack dashboard, and RegistryType in registry read responses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--service-name` flag to `generate` for naming Windows service implants at generation time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Redesigns `crack top` as a real-time dashboard with a top panel and benchmark cache policy. • Adds `RegistryType` field to registry read responses, exposing the value type alongside registry data. • Updates Go toolchain to v1.27 for implant and server builds. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.7.7 https://github.com/BishopFox/sliver/releases/tag/v1.7.7 Thu, 03 Sep 2026 17:53:42 GMT Sliver v1.7.7 adds OPFOR CNA BOF scripting and hardens portfwd/SOCKS5 tunnels • Hardens `portfwd` and SOCKS5 tunnels for improved reliability and stability. • Reworks reverse port forwarding lifecycle with end-to-end coverage improvements. • Improves Windows shell handling. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.7.6 https://github.com/BishopFox/sliver/releases/tag/v1.7.6 Fri, 28 Aug 2026 18:37:03 GMT Sliver v1.7.6 adds Go c-archive output, Reflektor-backed BOF/extension execution, native macOS/Linux extensions, configurable keepalive, and profile-driven external builder generation. • Adds `c-archive` as a supported Go output format for implant generation, enabling implants to be embedded as C static libraries. • Enables profiles to generate implants via external builders with `profiles generate external builder`, decoupling build configuration from the server. • Switches default BOF execution to use Reflektor, replacing the previous in-process execution model for improved isolation. • Switches implant extension loading to use Reflektor for reflective in-memory execution of extensions. • Adds native extension support on macOS and Linux (previously Windows-only), broadening cross-platform BOF/extension use. • Adds configurable keepalive intervals for implant C2 communications. • Makes multiplayer WireGuard transport explicitly opt-in rather than enabled by default. • Makes `mcp start` usable non-interactively, bypassing the interactive confirmation prompt. Breaking changes: • Multiplayer WireGuard is now explicitly opt-in; existing setups relying on WireGuard being enabled by default in multiplayer mode will need to re-enable it manually. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.7.2 https://github.com/BishopFox/sliver/releases/tag/v1.7.2 Mon, 23 Feb 2026 01:52:18 GMT Sliver v1.7.2 adds multi-shell management, Windows PE metadata spoofing, and local file tab completion. • Adds multi-shell management: background a shell with `ctrl+]`, list active shells with `shell ls`, and re-attach with `shell attach`. • Implements Windows PE metadata spoofing to blend implants into target environments. • Adds local file tab completion for most commands and flags. • Improves macOS shellcode loader. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.7.1 https://github.com/BishopFox/sliver/releases/tag/v1.7.1 Sun, 08 Feb 2026 22:38:32 GMT Sliver v1.7.1 adds Linux shellcode payload support and multi-console capability. • Adds shellcode payload generation/execution support targeting Linux implants. • Enables multiple simultaneous console sessions (multi-console) within the Sliver client. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.6.10 https://github.com/BishopFox/sliver/releases/tag/v1.6.10 Sun, 01 Feb 2026 02:04:53 GMT Sliver v1.6.10 adds xxd command, shellcode encoders, WASM Donut support, and expanded chtimes time formats. • Adds `xxd` command for hex-dump inspection of data from within a session. • Adds shellcode encoders for payload generation. • Adds WASM-based Donut integration for in-memory shellcode generation. • Expands time formats accepted by `chtimes` for more flexible timestamp manipulation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.6.9 https://github.com/BishopFox/sliver/releases/tag/v1.6.9 Fri, 30 Jan 2026 04:55:05 GMT Sliver v1.6.9 adds certificate DB storage, a new `edit` command, and an operator notification system. • Adds certificate storage in a database (`certs db`) for improved cert management. • Adds new `edit` command for in-session editing capabilities. • Adds a notifications feature to alert operators of session and implant events. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.6.8 https://github.com/BishopFox/sliver/releases/tag/v1.6.8 Thu, 29 Jan 2026 04:29:35 GMT Sliver v1.6.8 adds YAML format support for implant/server configurations. • Supports YAML format for configs, enabling human-readable configuration files alongside existing formats. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.6.7 https://github.com/BishopFox/sliver/releases/tag/v1.6.7 Wed, 28 Jan 2026 05:21:14 GMT Sliver v1.6.7 adds a website info command and SQLite pragma configuration for the database. • New `website` info capability for inspecting hosted website details from the server. • Adds SQLite pragma support to the database configuration for tuning database behavior. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.6.3 https://github.com/BishopFox/sliver/releases/tag/v1.6.3 Wed, 14 Jan 2026 00:42:59 GMT Sliver v1.6.3 adds argument tab-completion for aliases and extensions in the interactive console. • Adds argument completion for aliases and extensions, enabling tab-completion of arguments when invoking custom aliases or loaded extensions in the Sliver console. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.6.2 https://github.com/BishopFox/sliver/releases/tag/v1.6.2 Thu, 08 Jan 2026 21:11:08 GMT Sliver v1.6.2 adds --rc flag for scripting initial console inputs at startup. • Adds `--rc` flag to supply a script file of initial inputs for automating the Sliver console at startup. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.6.1 https://github.com/BishopFox/sliver/releases/tag/v1.6.1 Sun, 04 Jan 2026 20:33:18 GMT Sliver v1.6.1 adds experimental MCP support, a new `aka` command for aliases, and improved implant build layout. • Adds experimental MCP (Model Context Protocol) support for AI-assisted C2 interaction. • New `aka` command lets operators define custom command aliases within the Sliver console. • Improves implant build layout for cleaner artifact organization. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.6.0 https://github.com/BishopFox/sliver/releases/tag/v1.6.0 Thu, 01 Jan 2026 15:55:20 GMT Sliver v1.6.0 adds memory files, Tailscale multiplayer, bulk tasking, grep/head/tail, RC4 stagers, operator permissions, and more. • Adds memory file feature for in-memory file operations on implants. • Adds Tailscale integration for multiplayer C2 operator connectivity. • Adds `profiles info` subcommand and saves poll timeout in implant profiles. • Adds command to task many implants at once (bulk tasking). • Adds `grep` command for searching remote file content. • Adds `head` and `tail` commands for reading the start/end of remote files. • Adds `cp` (copy file) command for copying files on the remote host. • Adds ability to upload entire directories with the `upload` command. • Adds WASM output support in beacon mode. • Adds RC4 encryption support to shellcode stager. • Adds ability to generate `.exe` MSF stagers directly from Sliver. • Adds customization of the LURI for MSF stager payloads. • Adds advanced options for MSF stager generation. • Adds DNS C2 without TXT record support (`notxt` DNS mode). • Adds C2 server-signing for enhanced communication integrity. • Adds operator permissions system for role-based access control in multiplayer mode. • Adds selective staging support for stage listeners. • Adds profile update capability. • Adds HTTP C2 configuration support for external builds. • Adds console session asciicast recorder for session replay. • Adds server-side console log rotation and compression. • Adds RPC-level audit logging with additional details. • Adds hidden window support for executed processes on Windows implants. • Adds HTTP proxy fallback to direct connection when proxy fails. • Adds option to disable fallback connection to TCP/80 when TCP/443 is unreachable. • Adds more detail about stage listeners in the `jobs` command output. • Adds Cybereason ActiveProbe to the known security processes list. • Stores Shikata Ga Nai (SGN) encoding preference within implant profiles. • Adds validation for advanced C2 options during implant generation. • Adds client-side error reporting for invalid/unsupported TLS certificates on HTTPS listeners. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.39 https://github.com/BishopFox/sliver/releases/tag/v1.5.39 Tue, 16 May 2023 15:43:20 GMT Sliver v1.5.39 allows specifying DNS resolvers via advanced implant options • Adds `dns.resolvers` to the advanced implant generation options for customizing outbound DNS resolution Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.37 https://github.com/BishopFox/sliver/releases/tag/v1.5.37 Thu, 13 Apr 2023 17:56:33 GMT Adds chmod/chown/timestomp operations to ls, beacon C2 change on spawn, short-ID kill, and hostname display • `ls` command now supports `chmod`, `chown`, `timestomp` subcommands and displays `uid:gid` in the listing output. • Beacon kill command now accepts the short form of the beacon ID as an argument, not just the full UUID. • The beacon list view now always includes the `hostname` column in its output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.36 https://github.com/BishopFox/sliver/releases/tag/v1.5.36 Sun, 26 Mar 2023 20:38:04 GMT Sliver v1.5.36 adds `armory` support for private Github APIs to enable asset scanning of authenticated repositories. • Adds `armory` support for private Github apis Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.34 https://github.com/BishopFox/sliver/releases/tag/v1.5.34 Tue, 07 Feb 2023 16:41:20 GMT Adds Defender for Endpoint processes to Sliver's session enumeration output • `session` commands now enumerate and display `Defender for Endpoint` process information in the client output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.32 https://github.com/BishopFox/sliver/releases/tag/v1.5.32 Tue, 03 Jan 2023 23:42:33 GMT Sliver v1.5.32 adds debug target support and --skip-dns flag for beacon generation • Adds `--skip-dns` flag to allow skipping reverse DNS lookups during beacon initialization • Adds `--debug-target` option to specify a debug target for beacon operations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.31 https://github.com/BishopFox/sliver/releases/tag/v1.5.31 Fri, 04 Nov 2022 01:11:00 GMT Sliver v1.5.31 adds ps tree support, lets users choose logon type with CreateProcessWithLogonW • `ps` agent command now supports a `--tree` flag to display the process hierarchy on the compromised host. • Adds `CreateProcessWithLogonW` as a new implant execution method, enabling users to choose the logon type during process creation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.30 https://github.com/BishopFox/sliver/releases/tag/v1.5.30 Mon, 17 Oct 2022 21:21:51 GMT Adds external build workflow with `template_name` field and `--disable-sgn` CLI flag • Implements a basic external builder workflow allowing agents to be built via an external system instead of the local compiler • Adds the `template_name` field to support naming templates for external builds • Adds the `--disable-sgn` command-line flag to sgn operations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.28 https://github.com/BishopFox/sliver/releases/tag/v1.5.28 Thu, 29 Sep 2022 04:15:33 GMT Sliver v1.5.28 adds Kerberos SSH, HTTPS stagers, cookie-stealing CLI, and session info fields. • New `cursed cookies cmd` subcommand with `:file` option steals browser cookies and saves them to disk • `HTTPS stagers` are now supported as a payload generation format for implant delivery • The `info` command now displays the `FirstContact` timestamp for beacons/sessions • Implants can now be limited by locale using regexp via the new `LimitLocale` field in `client.proto` Breaking changes: • The `-n` flag is removed from the reconfig command; renaming is now handled by the rename subcommand Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.27 https://github.com/BishopFox/sliver/releases/tag/v1.5.27 Wed, 21 Sep 2022 00:43:16 GMT Sliver v1.5.27 adds reverse port forwarding, external build and events APIs, TLS key logging, implant locale data, JARM fingerprint randomization, and Wireguard session key persistence. • Adds `start` and `stop` commands for reverse port forwarding (rportfwd) on implants • Adds an external build API with a dedicated events API endpoint to track build progress • Enables TLS key logging via the `SSLKEYLOGFILE` environment variable for Wireshark packet decryption • Injects locale information into implant sessions and beacons using generated protobuf definitions • Optionally randomizes the server's JARM fingerprint to reduce passive identification surface Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.26 https://github.com/BishopFox/sliver/releases/tag/v1.5.26 Tue, 06 Sep 2022 18:59:12 GMT Sliver v1.5.26 adds Carbon Black cloud sensor support and improves sideload payload with `ppid` and process args • Adds support for the Carbon Black Cloud sensor for operator concealment. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.25 https://github.com/BishopFox/sliver/releases/tag/v1.5.25 Mon, 05 Sep 2022 00:42:07 GMT In-proc execute-assembly support, RegistryType protobuf enum, and in-memory electron cmd for Sliver • Add in-proc support to execute-assembly, allowing assemblies to run inside the implant process rather than spawning a new one. • Adds `RegistryType` to the protobuf schema to correctly distinguish registry key types. • Initial implementation of in-memory `execute-electron` command via the overlord subsystem. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.23 https://github.com/BishopFox/sliver/releases/tag/v1.5.23 Wed, 24 Aug 2022 21:01:50 GMT Adds chunked delivery, PPID spoofing for fork/exec, and SGN integration for shellcode generation • Adds `delivery.in.chunks` support to enable large file transfers in segments rather than a single blob • Adds `ppid_spoof` and `custom_process_args` fields to the fork/exec command payload for stealthier process creation • Adds SGN integration to `execute-shellcode` and `generate` commands, allowing signed shellcode execution via the new sgn backend Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.22 https://github.com/BishopFox/sliver/releases/tag/v1.5.22 Wed, 17 Aug 2022 02:58:36 GMT Adds deflate9 compression and configurable stage compression to Sliver payloads. • Adds `--deflate9` flag to payload generation for enhanced compression ratio • Makes stage compression configurable via new `--compress` option Breaking changes: • Stage compression is now off by default (previously compressed) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.19 https://github.com/BishopFox/sliver/releases/tag/v1.5.19 Tue, 19 Jul 2022 02:04:44 GMT Sliver v1.5.19 adds process architecture to the ps command and fixes profiles flag • Adds `architecture` field to the output of the `ps` command, showing the target process's architecture (e.g., x64, ARM) • Adds `name` flag to the `profiles` subcommand to filter or select specific profile configurations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.18 https://github.com/BishopFox/sliver/releases/tag/v1.5.18 Sat, 16 Jul 2022 01:43:34 GMT Adds filtering to the download command and configurable vim mode in client settings • `download` command now supports filtering files during the archive creation process • Vim editing mode for the shell is now configurable via a new client setting Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.16 https://github.com/BishopFox/sliver/releases/tag/v1.5.16 Thu, 09 Jun 2022 22:55:39 GMT Sliver v1.5.16 adds Outline auth support for private armories • Adds `Outline` authentication support for private armories Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.15 https://github.com/BishopFox/sliver/releases/tag/v1.5.15 Tue, 07 Jun 2022 21:07:06 GMT Sliver v1.5.15 enables Domain Fronting for operator traffic routing. • Enables `domain_fronting` to route implant C2 traffic through CDN-hosted domains. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.14 https://github.com/BishopFox/sliver/releases/tag/v1.5.14 Mon, 30 May 2022 01:42:01 GMT Adds `armory install all` CLI subcommand • Adds `armory install all` command to install all armory assets Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.13 https://github.com/BishopFox/sliver/releases/tag/v1.5.13 Sat, 28 May 2022 18:53:14 GMT Sliver v1.5.13 adds `--loot` support to the `download` command and improves beacon timing accuracy. • Adds `--loot` flag to the `download` command so downloaded files are saved into the loot directory • Improves beacon interval calculation by moving the check server-side for accurate display Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.11 https://github.com/BishopFox/sliver/releases/tag/v1.5.11 Fri, 15 Apr 2022 00:05:25 GMT Sliver v1.5.11 adds impersonated token viewing, Linux procdump support, and beacon/session filters. • Adds `whoami` command output showing the current impersonated token • Adds `procdump` loader support for Linux builds • Adds HTTP proxy support via `HTTPS_PROXY` environment variable • Adds `--dns-otp-auth=false` option to disable DNS OTP authentication • Adds new `filter` and `filter-re` commands for beacons and sessions • Adds prompt-to-user credential collection feature • Adds proxy credential prompting option Breaking changes: • Removes the `totp <-> dns session id` mapping used for session identity Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.10 https://github.com/BishopFox/sliver/releases/tag/v1.5.10 Wed, 23 Mar 2022 18:57:28 GMT Adds the `mv` command to rename files on the implant. • Updates Go toolchain support to v1.18 and updates garble with `-seed=random` support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.9 https://github.com/BishopFox/sliver/releases/tag/v1.5.9 Wed, 16 Mar 2022 17:00:26 GMT v1.5.9 adds AES stage encryption, run-at-load flag for DLLs, and Operator beacon support • Adds `--stage-encryption` flag to encrypt payload stages via AES encryption • Adds `run-at-load` flag to shared libraries (DLL/so) to execute entry point on load • Adds beacon support for the Operator profile, enabling operators to receive beacons directly Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.6 https://github.com/BishopFox/sliver/releases/tag/v1.5.6 Wed, 23 Feb 2022 02:27:55 GMT Adds JS_TYPE to pivot protos and logs beacon registrations in audit log • `JS_TYPE` is now a field in the pivot protocol buffers for more granular control over pivoting operations. • Beacon registration events are now written to the audit log. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver https://github.com/BishopFox/sliver/releases/tag/v1.5.5 https://github.com/BishopFox/sliver/releases/tag/v1.5.5 Sun, 13 Feb 2022 01:16:49 GMT Sliver v1.5.5 adds the `reconfig` and `rename` subcommands for beacon management • Adds the `reconfig` command to update configuration parameters for existing beacons • Adds the standalone `rename` subcommand to change a beacon's alias Breaking changes: • The rename functionality has been moved from the `reconfig` command into its own dedicated `rename` subcommand; existing automation using `reconfig` for renames will break or behave incorrectly. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sliver