When running Sliver for red team engagements, your C2 server IP can potentially be exposed through implant traffic analysis or if the implant gets captured and analyzed.

One way to solve this is routing C2 traffic through Tor hidden services. The implant connects to a .onion address, your real infrastructure stays hidden.

The setup:

1. Sliver runs normally with an HTTPS listener on localhost

2. A proxy sits in front of Sliver, listening on port 8080

3. Tor creates a hidden service pointing to that proxy

4. Implants get generated with the .onion URL

Traffic flow:

implant --> tor --> .onion --> proxy --> sliver

The proxy handles the HTTP-to-HTTPS translation since Sliver expects HTTPS but Tor hidden services work over raw TCP.

Why not just modify Sliver directly?

Sliver is written in Go and has a complex build system. Adding Tor support would require maintaining a fork. Using an external proxy keeps things simple and works with any Sliver version.

Implementation:

I wrote a Python tool that automates this: https://github.com/Otsmane-Ahmed/sliver-tor-bridge

It handles Tor startup, hidden service creation, and proxying automatically. Just point it at your Sliver listener and it generates the .onion address.

Curious if anyone else has solved this differently or sees issues with this approach.