# HTMLSmuggler ✉️
[](https://opensource.org/licenses/MIT)
HTMLSmuggler - JS payload generator for IDS bypass and payload delivery via HTML smuggling.
## Description
The full explanation what is HTML Smuggling may be found [here](https://outflank.nl/blog/2018/08/14/html-smuggling-explained/).
The primary objective of HTML smuggling is to bypass network security controls, such as firewalls and intrusion detection systems, by disguising malicious payloads (e.g. executables/archives/etc.) within seemingly harmless HTML and JavaScript code. By exploiting the dynamic nature of web applications, attackers can deliver malicious content to a user's browser without triggering security alerts or being detected by traditional security mechanisms. Thanks to this technique, the download of a malicious file is not displayed in any way in modern IDS solutions.
The main goal of HTMLSmuggler tool is creating an independent javascript library with embedded malicious user-defined payload. This library may be integrated into your phishing sites/email html attachments/etc. to deliver embedded payload to the target user system (bypassing IDS and IPS system). An example of created javascript library may be found [here](examples/html/payload.umd.js).
## Features
* Built-in highly configurable JavaScript obfuscator that fully hides your payload makes it impossible to extract your payload from javascript manually.
* Powerful client-side bots and headless crawlers detection library that doesn't share your payloads with smart secure mail gateways and their friends.
* Delay before loading to avoid sandboxes that are in a hurry.
* May be used both as an independent JS library or embedded in JS frameworks such as React, Vue.js, etc.
* The simplicity of the template allows you to add extra data handlers/compressions/obfuscations.
* Support a lot of browsers (including old IE10).
## Installation
1. [Install yarn](https://classic.yarnpkg.com/lang/en/docs/install/) package manager.
2. Install dependencies:
```bash
yarn
```
3. Read help message.
```bash
yarn build -h
```
```text
Options:
-p, --payload Path to payload file you want to smuggle
-n, --name Name of file, that would be downloaded
-t, --type Contet-Type of downlonaded file (default: "application/octet-stream")
-f, --function Name of exported function (default: "download")
-c, --compress Enable payload compression (gzip)
-d, --delay Delay before antibot and download in ms (default: 0)
-a, --antibot Enable bot detection and block them (recommended)
-h, --help display help for command
```
## Usage
### Preparation steps
1. **(Optional)** Modify [javascript-obfuscator options](https://github.com/javascript-obfuscator/javascript-obfuscator#javascript-obfuscator-options) in `obfuscator.js`, my preset is nice, but very slow.
2. Compile your javascript payload:
> ⚠️ AVOID USAGE OF PAYLOADS BIGGER THAN 3 MiB (see [FAQ](#faq))
```bash
yarn build -p /path/to/payload -n file.exe -t "application/octet-stream" -c -a -d 3000
```
3. Get your payload from `dist/payload.esm.js` or `dist/payload.umd.js`. After that, it may be inserted into your page and called with `download()` (or custom specified with `-f` flag) function.
> `payload.esm.js` is used in `import { download } from 'payload.esm';` imports (ECMAScript standart).
>
> `payload.umd.js` is used in html script SRC and `require('payload.umd');` imports (CommonJS, AMD and pure html).
### Pure HTML example
A full example may be found [here](examples/html/).
1. Do [preparation steps](#preparation-steps).
2. Import created script to html file (or insert it inline):
```html
```
3. Call `download()` function from body:
```html
```
4. Happy phishing :)
### VueJS example
A full example may be found [here](examples/vuejs/).
1. Do [preparation steps](#preparation-steps).
2. Import created script to vue file:
```vue
```
3. Call `download()` function:
```vue
```
4. Happy phishing :)
## FAQ
**Q**: I have an error `RangeError: Maximum call stack size exceeded`, how to solve it?
**A**: This [issue described here](https://github.com/javascript-obfuscator/javascript-obfuscator/issues/89). To fix it, try to disable `splitStrings` in `obfuscator.js` or make smaller payload (it's recommended to use up to 2 MB payloads because of this issue).
---
**Q**: Why does my payload build so long?
**A**: The bigger payload you use, the longer it takes to create a JS file. To decrease time of build, try to disable `splitStrings` in `obfuscator.js`. Below is a table with estimated build times using default `obfuscator.js`.
| Payload size | Build time |
| --- | --- |
| 525 KB | 53 s |
| 1.25 MB | 8 m |
| 3.59 MB | 25 m |