How b-3llum/sliver-lab works
sliver-lab is a browser-based operator console for an authorized Sliver red-team lab. The principal workflow is operator authentication, reviewing live sessions or beacons, opening a session console to issue operations, and observing task and teamserver events; separate screens manage listeners, tunnels, files, loot, builds, profiles, BOFs, jobs, graphs, audit, and reports. The FastAPI BFF authenticates API routes and brokers operations to Sliver, while a shared WebSocket fans events to the UI. Uninspected route implementations are represented by their exact tree paths; their finer-grained wiring is not inferred.
Main entry points: main.py FastAPI entry · App.tsx App routes · api.ts HTTP API client · sliver_client.py Sliver event hub
Components 23
Operator UI
- App routes
ui/frontend/src/App.tsx - Auth gate
ui/frontend/src/components/AuthGate.tsx - HTTP API client
ui/frontend/src/api.ts - Event client
ui/frontend/src/ws.ts - Sessions console
ui/frontend/src/views/Sessions.tsx - Implant console
ui/frontend/src/views/Console.tsx - Management screens
ui/frontend/src/views/Listeners.tsx - Artifacts screens
ui/frontend/src/views/Build.tsx - Visibility screens
ui/frontend/src/views/Audit.tsx
API backend
- FastAPI entry
ui/backend/main.py - Session routes
ui/backend/routes/sessions.py - Other domain routes
ui/backend/routes/graph.py - Sliver event hub
ui/backend/sliver_client.py - WebSocket endpoint
ui/backend/ws.py
Implant operations
- Build and artifact routes
ui/backend/routes/build.py - Task routes
ui/backend/routes/tasks.py - Task registry
ui/backend/task_registry.py
Lab infrastructure
- Listener and tunnel routes
ui/backend/routes/listeners.py - Tunnel registry
ui/backend/tunnel_registry.py - Ngrok routes
ui/backend/routes/ngrok.py - Ngrok registry
ui/backend/ngrok_registry.py
Other components
- Operator
- Sliver teamserver
Connections 34
- Operator → Auth gate: enters token
- Auth gate → App routes: unlocks UI
- App routes → Sessions console: routes to
- App routes → Implant console: routes to
- App routes → Management screens: routes to
- App routes → Artifacts screens: routes to
- App routes → Visibility screens: routes to
- Sessions console → HTTP API client: fetches sessions
- Implant console → HTTP API client: sends operations
- Management screens → HTTP API client: calls endpoints
- Artifacts screens → HTTP API client: calls endpoints
- Visibility screens → HTTP API client: calls endpoints
- HTTP API client → FastAPI entry: HTTP requests
- FastAPI entry → Session routes: dispatches
- FastAPI entry → Listener and tunnel routes: dispatches
- FastAPI entry → Ngrok routes: dispatches
- FastAPI entry → Build and artifact routes: dispatches
- FastAPI entry → Task routes: dispatches
- FastAPI entry → Other domain routes: dispatches
- Session routes → Sliver event hub: queries sessions
- Listener and tunnel routes → Tunnel registry: manages tunnels
- Ngrok routes → Ngrok registry: manages tunnels
- Build and artifact routes → Task registry: tracks tasks
- Task routes → Task registry: reads task results
- FastAPI entry → Sliver event hub: starts and stops
- Sliver event hub → Sliver teamserver: connects and receives events
- FastAPI entry → WebSocket endpoint: mounts endpoint
- Sliver event hub → WebSocket endpoint: fans out events
- Task registry → Sliver event hub: broadcasts updates
- Event client → WebSocket endpoint: subscribes to events
- Sessions console → Event client: refreshes on events
- Implant console → Event client: observes events
- Operator → Sliver teamserver: implant activity
- Build and artifact routes → Operator: optional avgen hook