nccgroup/demiguise

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1429 stars · 245 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Demiguise is a Python CLI tool from NCC Group that generates HTML files containing RC4-encrypted HTA payloads, which are decrypted dynamically in the browser at runtime. It is designed for red team operations to bypass content/file-type inspection by security appliances and evade sandboxing via environmental keying.

Use cases

• encrypt an HTA payload inside an HTML page to evade proxy inspection
• generate HTA files for red team phishing simulations
• bypass security appliance file-type filtering
• use environmental keying to avoid sandbox detonation
• deliver payloads without plaintext HTA over HTTP
• test detection of encrypted HTA delivery techniques

When to choose

• you are a red teamer needing to deliver HTA payloads past content inspection
• you want encrypted, browser-decrypted payload delivery with environmental keying
• you need a lightweight Python tool for offensive HTA generation

When to avoid

• you need to author sophisticated HTA payload content itself
• you are building defensive tooling rather than offensive simulations
• you need a maintained tool with recent updates or broad platform support

Facets

cli-tool · maturity maintenance

security cryptography cli security penetration-testing python cli windows red-team hta evasion offensive-security rc4 environmental-keying

Member repositories

For agents

markdown · JSON · MCP: product_card(name="nccgroup/demiguise")