Affected by GO-2024-2993 and 3 other vulnerabilities

GO-2024-2993: Sliver Allows Authenticated Operator-to-Server Remote Code Execution in github.com/bishopfox/sliver

GO-2026-4280: Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass in github.com/bishopfox/sliver

GO-2026-4466: Sliver has DNS C2 OTP Bypass that Allows Unauthenticated Session Flooding and Denial of Service in github.com/bishopfox/sliver

GO-2026-4609: Sliver is Vulnerable to Authenticated Nil-Pointer Dereference through its Handlers in github.com/bishopfox/sliver

transport

package

v1.7.2 Latest Latest Go to latest Published: Feb 23, 2026 License: GPL-3.0 Imports: 14 Imported by: 9

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/bishopfox/sliver

Links

Open Source Insights

README ¶

client/transport

Overview

Client-side transports and RPC wiring to communicate with Sliver servers. Builds authenticated gRPC clients, TLS dialers, and reconnect logic. Core logic addresses mTLS within the transport package.

Go Files

mtls.go – Configures the mutual TLS gRPC transport, including dial options and credential refresh logic.

Documentation ¶

Index ¶

Constants
func MTLSConnect(config *assets.ClientConfig) (rpcpb.SliverRPCClient, *grpc.ClientConn, error)
func RootOnlyVerifyCertificate(caCertificate string, rawCerts [][]byte) error
func SetKeepaliveParams(p keepalive.ClientParameters)
type TokenAuth
- func (t TokenAuth) GetRequestMetadata(ctx context.Context, in ...string) (map[string]string, error)
- func (TokenAuth) RequireTransportSecurity() bool

Constants ¶

View Source

const (

	// ClientMaxReceiveMessageSize - Max gRPC message size ~2Gb
	ClientMaxReceiveMessageSize = (2 * gb) - 1 // 2Gb - 1 byte

)

Variables ¶

This section is empty.

Functions ¶

func MTLSConnect ¶

func MTLSConnect(config *assets.ClientConfig) (rpcpb.SliverRPCClient, *grpc.ClientConn, error)

MTLSConnect - Connect to the sliver server

func RootOnlyVerifyCertificate ¶ added in v1.5.0

func RootOnlyVerifyCertificate(caCertificate string, rawCerts [][]byte) error

RootOnlyVerifyCertificate - Go doesn't provide a method for only skipping hostname validation so we have to disable all of the certificate validation and re-implement everything. https://github.com/golang/go/issues/21971

func SetKeepaliveParams ¶ added in v1.7.0

func SetKeepaliveParams(p keepalive.ClientParameters)

SetKeepaliveParams configures gRPC keepalive pings for future MTLSConnect dials. Behavior is unchanged unless this is called.

Types ¶

type TokenAuth ¶ added in v1.5.0

type TokenAuth struct {
	// contains filtered or unexported fields
}

func (TokenAuth) GetRequestMetadata ¶ added in v1.5.0

func (t TokenAuth) GetRequestMetadata(ctx context.Context, in ...string) (map[string]string, error)

Return value is mapped to request headers.

func (TokenAuth) RequireTransportSecurity ¶ added in v1.5.0

func (TokenAuth) RequireTransportSecurity() bool

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL