A toolkit for secure file encryption, splitting, and covert transfer — designed for red team operations. By fragmenting encrypted data streams across multiple HTTP transactions, it increases the complexity of detection and reassembly for blue teams.
[Encryptor] → AES-CBC encrypt → split into N parts → [Serve or Upload]
↓
[Receiver reassembles + decrypts]
Two delivery modes:
| Mode | Description |
|---|---|
| Side Load | Operator-controlled server serves encrypted parts; target client fetches and decrypts in-browser |
| Upload | Target client encrypts and uploads parts to operator-controlled receiver |
.
├── Side_Load/
│ ├── config.ini # Shared config (hostname, key, part count)
│ ├── Encryptors/
│ │ ├── python/slice.py # Encrypt + split a file (Python)
│ │ └── cs/Dice.cs/ # Encrypt + split a file (C#, AES-128-CBC)
│ └── Decryptor/
│ ├── serve.py # Flask server — serves encrypted parts
│ └── templates/SideLoadMe.html
└── Upload/
└── Flask/
├── config.ini
├── serve.py # Flask receiver — accepts, reassembles, decrypts
└── templates/
├── index.html
└── upload.html # Browser-side encrypt + upload UI
- Python 3.9+ (stdlib
venvis sufficient — novirtualenvinstall needed) - .NET 9+ SDK (for the C# encryptor)
git clone https://github.com/incendiary/Slice-N-Dice.git
cd Slice-N-DiceStep 1 — encrypt and split the file (Python encryptor)
cd Side_Load/Encryptors/python
python -m venv .venv && source .venv/bin/activate # Windows: .venv\Scripts\activate
pip install -r requirements.txt
python slice.py <file_to_encrypt>
# Writes encrypted parts + iv.bin + salt.bin to Side_Load/Decryptor/Downloads/Step 1 (alternative) — C# encryptor
cd Side_Load/Encryptors/cs/Dice.cs
dotnet run --project Dice.cs -- ../../config.ini <file_to_encrypt>Step 2 — serve the encrypted parts
cd Side_Load/Decryptor
python -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
python serve.pyBrowse to http://<ServerHostname> — the page fetches, verifies (SHA-256), and decrypts the file in the browser using the Web Crypto API.
cd Upload/Flask
python -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
python serve.pyBrowse to http://<ServerHostname>, select a file, and enter an encryption key. The browser encrypts and splits the file before uploading each part.
Security: Change
ApiTokeninconfig.inito a random value before deploying. The defaultchange-meplaceholder will be rejected by any operator who reads this README.
Each mode has its own config.ini. Edit the one in the relevant directory before running:
Side Load (Side_Load/config.ini):
[DEFAULT]
ServerHostname = <your-server-ip>
NumberOfFiles = 3
EncryptionKey = <strong-passphrase>
DownloadName = output.docx
[SERVER]
Port = 80
DebugMode = OffUpload (Upload/Flask/config.ini):
[DEFAULT]
ServerHostname = <your-server-ip>
NumberOfFiles = 3
EncryptionKey = <strong-passphrase>
UploadDirectory = uploads
ApiToken = <random-token>
[SERVER]
Port = 80
DebugMode = OffNever commit a
config.inicontaining real values. The defaults are placeholders only.
- README accuracy pass: correct prerequisites,
python -m venv .venvsetup, per-mode config examples, C# encryptor usage, ApiToken security callout
- Added
[project]metadata topyproject.toml(name, version, description,requires-python) - Added
[tool.coverage.run/report]config topyproject.toml - Aligned black
target-versionto supported Python matrix (3.9–3.11) - Opened issue #14 for missing Side_Load/Decryptor test coverage
- Removed dead
recombine_file()function (never called) - Made
derive_key()password argument required (removes silent-weak-key footgun) - Documented
USER_SUPPLIED_KEYsingle-session design constraint - Removed what-comments and redundant docstring noise from Python source
- Bumped all Python deps to current stable (Flask 3.1.3, Werkzeug 3.1.8, pycryptodome 3.23.0)
- Updated pre-commit hooks to latest (gitleaks v8.30.1, black 26.3.1, isort 8.0.1, flake8 7.3.0)
- Fixed all pre-existing CI failures (pylint, dotnet-format, line-ending mismatch)
- Sanitised engagement-specific IP address from config before public release
- Python AES-CBC encryptor with PBKDF2 key derivation
- Flask side-load server (serve encrypted parts to browser)
- Flask upload receiver (browser-side encrypt + multi-part upload)
- Browser-based decryption via Web Crypto API
- C# encryptor (Dice.cs) — matches Python encryptor parameters exactly
- API token authentication on all upload receiver endpoints
- 18-test pytest suite covering crypto, upload logic, and auth
| # | Status | Description |
|---|---|---|
| #16 | ✅ Done (v1.0.4) | README accuracy pass — prerequisites, setup, config, C# instructions |
| #9 | ✅ Done (v1.0.2) | Remove dead recombine_file() from Upload/Flask/serve.py |
| #10 | ✅ Done (v1.0.2) | Remove misleading default password in derive_key() |
| #11 | ✅ Done (v1.0.2) | Document USER_SUPPLIED_KEY single-session design constraint |
| #12 | ✅ Done (v1.0.2) | Remove what-comments and redundant docstring noise from Python source files |
| #14 | 🔮 Future | Add unit tests for Side_Load/Decryptor/serve.py (zero coverage currently) |
| #24 | ✅ Done | End-to-end integration tests for encrypt → split → reassemble → decrypt pipeline |
| #25 | ✅ Done | --chunk-size BYTES CLI flag for slice.py (overrides NumberOfFiles from config) |
| #26 | ✅ Done | SHA-256 checksum of encrypted payload saved to file.sha256 after splitting |
| #27 | ✅ Done | Coverage badge (Codecov) in README |
| — | 🔮 Future | Fix IV reuse across file parts in upload mode |
| — | 🔮 Future | Replace plaintext key transmission with a proper key-exchange mechanism |
| — | 🔮 Future | Split uploads across multiple independent services |
| — | 🔮 Future | User-selectable encryption algorithm |
| — | 🔮 Future | Upload success/failure feedback to client |
This project was prepared for public release with the assistance of Claude Code, following karpathy-style engineering guidelines (surgical changes, simplicity-first, no speculative abstractions). Things should work, but in some cases I haven't been able to verify every path end-to-end. PRs and fixes are very welcome.
This tool is intended for authorised red team engagements only. Ensure you have explicit written permission before deploying against any target environment.