Advanced Red Team Payload Obfuscation Engine
Free & Open Source — Browser-Based — No Data Leaves Your Machine

🌐 Live Demo • Features • Quick Start • Languages • Layers

⚠️ For authorized security testing and educational purposes only. Do not use against systems you do not own or have explicit permission to test.

🔓 100% Client-Side — All obfuscation runs in your browser. Zero server calls. Your payloads never leave your machine.

🧅 8 Stackable Layers — Combine any layers together for maximum evasion depth. Each layer adds a different evasion dimension.

🔤 5 Languages — PowerShell, Python, Bash, C#, and Go with language-specific awareness.

🔬 Context-Aware Tokenizer — Custom parser that understands strings, comments, interpolation, f-strings, here-strings, and escape sequences per language. Never breaks syntax.

📊 Real-Time Analysis — Shannon entropy meter, detection probability scoring, per-layer breakdown, and output validation.

🎯 Unicode Safe — B64-first encoding pipeline ensures Greek, Chinese, Emoji, and any Unicode characters work flawlessly across all layers.

🆓 Completely Free — No tiers, no paywalls, no accounts. Every feature is available to everyone.

All 8 layers can be combined in any order. Each layer operates independently and adds a unique evasion dimension:

Each time you encrypt, one of these polymorphic methods is randomly selected:

All methods use B64-first encoding (Base64 before encryption) to guarantee Unicode safety and prevent byte overflow.

The custom tokenizer (parser.js) splits source code into string, comment, and code tokens. Obfuscation engines only modify the appropriate token types — never breaking syntax, keywords, or structural delimiters.

Interpolated strings are split into static and variable segments:

• PowerShell: "Hello $name" → encoded_static + $name
• Python: f"Hello {name}" → encoded_static + str(name)
• Bash: "Hello $var" → encoded_static$var
• C#: $"Hello {name}" → string.Format(encoded, name)

All encoding and encryption operations use a Base64-first approach:

1. Resolve language-specific escape sequences (\n → real newline)
2. Encode string to Base64 (guaranteed ASCII, 0-127 range)
3. Apply XOR/shift/rotation on the safe B64 bytes
4. Decryption stub reverses: decrypt → Base64 decode → UTF-8 string

This prevents the Cannot convert value "913" to type System.Byte error when processing Unicode characters (Greek, CJK, Emoji, etc.).

• PowerShell: ScriptBlock::Create(), ExecutionContext.InvokeCommand, Invoke-Command (randomized)
• Bash: eval "$(…)" with variable indirection (no pipe/subshell scope loss)
• IEX Stealth: Auto-replaces IEX/Invoke-Expression with & ($ShellId[1]+$ShellId[13]+'X')

The built-in analysis panel provides real-time feedback:

• Shannon Entropy — Measures randomness (Higher = harder to fingerprint)
• Detection Score — Estimates probability of AV/EDR detection per active layer
• Size Ratio — Before/after payload size comparison
• Validation — Checks balanced delimiters and structural integrity

# Clone the repository
git clone https://github.com/Ilias1988/payload-obfuscator.git
cd payload-obfuscator

# Install dependencies
npm install

# Start development server
npm run dev

# Build for production
npm run build

Then open http://localhost:5173 in your browser.

Or just visit the Live Demo →

payload-obfuscator/
├── index.html                    # SEO-optimized shell
├── vite.config.js                # Vite configuration
├── tailwind.config.js            # Tailwind theme (dark terminal)
├── scripts/
│   └── build.mjs                 # Production build script
├── public/
│   ├── robots.txt
│   └── sitemap.xml
└── src/
    ├── App.jsx                   # Main application
    ├── main.jsx                  # React entry point
    ├── index.css                 # Tailwind + custom styles
    ├── components/
    │   ├── layout/               # Header, Footer
    │   ├── panels/               # Input, Output, Options, Analysis, Language
    │   ├── seo/                  # SEOHead, SEOContent
    │   └── ui/                   # CopyButton, EntropyMeter, Toast
    ├── data/
    │   └── techniques.js         # Languages, layers, templates
    ├── engines/
    │   ├── powershell.js         # PowerShell engine (8 layers)
    │   ├── python.js             # Python engine (6 layers)
    │   ├── bash.js               # Bash engine (6 layers)
    │   ├── csharp.js             # C# engine (8 layers)
    │   ├── golang.js             # Go engine (7 layers)
    │   ├── controlflow.js        # Scope-aware CFF engine
    │   └── amsi.js               # AMSI/ETW patch generator
    ├── hooks/
    │   └── useObfuscator.js      # Core state management
    └── utils/
        ├── encoding.js           # Base64, Hex, XOR, resolveLanguageEscapes()
        ├── entropy.js            # Shannon entropy + detection scoring
        ├── parser.js             # Context-aware tokenizer
        ├── randomization.js      # Variable/function name generation
        └── validator.js          # Output validation

7 pre-built payload skeletons included:

• ⚡ PowerShell Download Cradle
• 🛡️ AMSI Bypass Template
• 🏴 Master Payload v3.0 (AMSI + Stealth IEX + Download Cradle)
• 🐍 Python Reverse Shell
• 🐚 Bash Reverse Shell
• 🔷 C# Shellcode Loader Skeleton
• 🔹 Go Reverse Shell

MIT License — See LICENSE for details.

Ilias Georgopoulos

• 🌐 Website
• 💻 GitHub
• 🐦 X / Twitter

_{Built with ☕ and 🔥 for the red team community}