Go-powered red team framework
A Go-based command-and-control framework for authorized security operations. Certificate-bound identity, scoped operations, and an operator-first interface—engineered for precision.
Capability map / 01
Clear boundaries. Explicit permissions. Documented verification.
mTLS with mutual certificate authentication, AES-256-GCM encrypted TCP, HTTP polling with C2 profile masquerading, and DNS TXT-record tunnelling. Each transport is independently configurable and embeds credentials at build time via ldflags.
Transport referenceBuilt-in HTTP profiles that disguise beacon traffic as Microsoft Teams presence updates, Google Analytics beacons, or Cloudflare RUM telemetry. Custom profiles via YAML.
HTTP profilesLinux suite: sleep masking, polymorphic re-encryption, TLS fingerprint pinning, environment guardrails, anti-debug canary. Windows suite: ETW patching, AMSI bypass, NTDLL unhooking, PPID spoofing, indirect syscalls, SleepMask. Kill Date and Working Hours lifecycle controls.
OPSEC overviewFull interactive bash shell via Linux PTY. Windows agents use one-shot exec for command output. Requires session mode. Exit with Ctrl+Q.
Shell capabilityTunnel any TCP connection through the agent to unreachable network segments. SSH, RDP, database access — verified with live SSH tunneling through C2.
Port forwardingReal-time web dashboard with SSE live updates. Manage listeners, agents, sessions, tasks, and operations. Add listeners and activate agents directly from the browser.
Dashboard overviewTunnel C2 traffic over DNS TXT record queries — effective where HTTP/TCP is blocked. The agent encodes beacon data into base64-padded TXT lookups; the teamserver resolves queries via its embedded resolver on UDP/53. No external DNS provider required.
DNS transport docsSix kernel and userland modules targeting Windows telemetry: ETW patch, AMSI bypass, NTDLL unhooking from a clean on-disk copy, PPID spoofing to inherit a trusted parent, indirect syscalls via runtime trampoline, and SleepMask obfuscation during sleep intervals.
Windows OPSEC docsKill Date forces the agent to self-terminate after a configured UTC timestamp — no operator action required. Working Hours restricts beacon callbacks to a defined daily window, reducing noise outside business hours. Both are embedded at build time via ldflags.
Lifecycle referenceGarble integration rewrites symbol names, obfuscates string literals, and strips DWARF debug info at compile time. XOR obfuscation via ldflags XORs the agent's embedded server credential. The resulting binary has no visible function names, import table symbols, or plaintext strings.
Hardening flagsTransport matrix / 02
Choose based on the target environment. All transports embed credentials at build time — zero flags on the agent binary.
| Transport | Auth | Encryption | Default port | Firewall evasion | Interactive shell | Bandwidth |
|---|---|---|---|---|---|---|
| mTLS | Mutual certificate | TLS 1.3 | 4433 | Low — raw TLS on non-standard port | ✓ PTY (Linux) | High |
| TCP | HMAC token | AES-256-GCM | 4444 | Low — raw TCP | ✓ PTY (Linux) | High |
| HTTP | Embedded token | TLS (HTTPS) + profile | 443 / 80 | High — mimics web traffic via C2 profiles | ✓ PTY (Linux) | Medium |
| DNS | Embedded token | Base64 payload over UDP/53 | 53 | Very high — DNS rarely blocked egress | Limited (one-shot) | Low |
All transports support beacon and session mode. DNS interactive shell is one-shot exec; full PTY requires mTLS / TCP / HTTP. Transport reference
OPSEC stack / 03
Each module is opt-in, embedded at build time, and independently documented with ldflags and verification steps.
All modules are enabled via --opsec / --win-opsec flags at generate time. Presets: none · basic · full. OPSEC overview
Platform support / 04
Cross-compiled from the same Go source. Windows agents are produced with GOOS=windows CGO_ENABLED=1 and mingw-w64.
| Capability | Linuxamd64 | Windowsamd64 |
|---|---|---|
| mTLS transport | Supported | Supported |
| TCP transport | Supported | Supported |
| HTTP + C2 profiles | Supported | Supported |
| DNS transport | Supported | Supported |
| Interactive PTY shell | Full PTY | One-shot exec |
| TCP port forwarding | Supported | Supported |
| OPSEC modules | 5 modules
| 6 modules
|
| Kill Date / Working Hours | Supported | Supported |
| Garble + XOR hardening | Supported | Supported |
| Session + Beacon modes | Supported | Supported |
| Process listing | Supported | Supported |
| File system operations | Supported | Supported |
Windows cross-compilation requires mingw-w64. See the installation guide for toolchain setup.
Quick start / 05
Zero-flag agent deployment. Credentials embedded at build time via ldflags.
Read the full deployment guide# Start teamserver
./bin/sentrava-server
# Launch operator client
./bin/sentrava-client
# Create operation and generate agent
sentrava > operations create op1 --target 192.168.0.197
sentrava > generate --listener 192.168.0.199:4433
# Deploy on target
scp <package>/sentrava-agent user@target:~/
# On target: ./sentrava-agent
# Get a session
sentrava > sessions list
sentrava > sessions use <id>
sentrava > whoamiSystem topology / 06
The CLI and browser share server-side policy. The dashboard is optional.
Both operator interfaces share the same server-side policy and state.
Select a component to explore its role. Moving lines illustrate communication, not live traffic.
Use Sentrava only within a documented authorization boundary. Keep PKI, credentials, and test databases separate from production systems.
Framework comparison / 07
Sentrava brings a CLI and browser dashboard around one policy-aware teamserver. Here is how that approach compares with Sliver, Mythic and Havoc.
Use the CLI or the React dashboard. Both share server-side operation scope, identities and task state.
Agent enrollment, certificate revocation and role-based access are part of Sentrava’s documented MVP.
A Go teamserver and SQLite store keep operations, tasks and an event journal together.
Compare the documented approaches below. On smaller screens, scroll horizontally to see every framework.
| Design choice | SentravaIntegrated control plane | SliverConsole-led workflow | MythicComposable platform | HavocDesktop workspace |
|---|---|---|---|---|
| Operator interface | CLI + web dashboardCobra / REPL and React | Interactive CLISeparate operator clients | React web interfaceCollaborative browser workspace | Qt desktop clientSession table and graph views |
| Core architecture | Go + SQLitegRPC and an HTTPS dashboard gateway | Go client / serverServer and clients run on Linux, Windows and macOS | Container-based servicesGo, GraphQL, PostgreSQL and RabbitMQ | Teamserver + clientGo server with a C++ / Qt interface |
| Operator & task context | Scoped operationsRBAC, enrollment and task ownership checks | Multiplayer sessionsOperator-to-server authentication with mTLS | Operation trackingOperators, task history, artifacts and shared context | Shared teamserverRegistered operators and an event viewer |
| Extension approach | Source-level experimentationPlugins and OPSEC packages are experimental in the current MVP | Scriptable workflowsJavaScript / TypeScript and Python scripting | Plug-in servicesPayload types, C2 profiles and integrations in separate containers | Custom agents & modulesService integration and Python API |
The combination of CLI and browser access, SQLite-backed state and explicit enrollment / operation boundaries is its focus. These are design choices, not claims that other frameworks lack access control or task tracking.
This is a comparison of documented designs, not a performance, detection or security benchmark. Sentrava reflects its current development README; Mythic reflects the 4.0 documentation. Capabilities vary by release and installed agent. The original Havoc repository is archived.
Precision. Persistence. Control.