# HTMLSmuggler ✉️ [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) HTMLSmuggler - JS payload generator for IDS bypass and payload delivery via HTML smuggling. ## Description The full explanation what is HTML Smuggling may be found [here](https://outflank.nl/blog/2018/08/14/html-smuggling-explained/). The primary objective of HTML smuggling is to bypass network security controls, such as firewalls and intrusion detection systems, by disguising malicious payloads (e.g. executables/archives/etc.) within seemingly harmless HTML and JavaScript code. By exploiting the dynamic nature of web applications, attackers can deliver malicious content to a user's browser without triggering security alerts or being detected by traditional security mechanisms. Thanks to this technique, the download of a malicious file is not displayed in any way in modern IDS solutions. The main goal of HTMLSmuggler tool is creating an independent javascript library with embedded malicious user-defined payload. This library may be integrated into your phishing sites/email html attachments/etc. to deliver embedded payload to the target user system (bypassing IDS and IPS system). An example of created javascript library may be found [here](examples/html/payload.umd.js). ## Features * Built-in highly configurable JavaScript obfuscator that fully hides your payload makes it impossible to extract your payload from javascript manually. * Powerful client-side bots and headless crawlers detection library that doesn't share your payloads with smart secure mail gateways and their friends. * Delay before loading to avoid sandboxes that are in a hurry. * May be used both as an independent JS library or embedded in JS frameworks such as React, Vue.js, etc. * The simplicity of the template allows you to add extra data handlers/compressions/obfuscations. * Support a lot of browsers (including old IE10). ## Installation 1. [Install yarn](https://classic.yarnpkg.com/lang/en/docs/install/) package manager. 2. Install dependencies: ```bash yarn ``` 3. Read help message. ```bash yarn build -h ``` ```text Options: -p, --payload Path to payload file you want to smuggle -n, --name Name of file, that would be downloaded -t, --type Contet-Type of downlonaded file (default: "application/octet-stream") -f, --function Name of exported function (default: "download") -c, --compress Enable payload compression (gzip) -d, --delay Delay before antibot and download in ms (default: 0) -a, --antibot Enable bot detection and block them (recommended) -h, --help display help for command ``` ## Usage ### Preparation steps 1. **(Optional)** Modify [javascript-obfuscator options](https://github.com/javascript-obfuscator/javascript-obfuscator#javascript-obfuscator-options) in `obfuscator.js`, my preset is nice, but very slow. 2. Compile your javascript payload: > ⚠️ AVOID USAGE OF PAYLOADS BIGGER THAN 3 MiB (see [FAQ](#faq)) ```bash yarn build -p /path/to/payload -n file.exe -t "application/octet-stream" -c -a -d 3000 ``` 3. Get your payload from `dist/payload.esm.js` or `dist/payload.umd.js`. After that, it may be inserted into your page and called with `download()` (or custom specified with `-f` flag) function. > `payload.esm.js` is used in `import { download } from 'payload.esm';` imports (ECMAScript standart). > > `payload.umd.js` is used in html script SRC and `require('payload.umd');` imports (CommonJS, AMD and pure html). ### Pure HTML example A full example may be found [here](examples/html/). 1. Do [preparation steps](#preparation-steps). 2. Import created script to html file (or insert it inline): ```html ``` 3. Call `download()` function from body: ```html ``` 4. Happy phishing :) ### VueJS example A full example may be found [here](examples/vuejs/). 1. Do [preparation steps](#preparation-steps). 2. Import created script to vue file: ```vue ``` 3. Call `download()` function: ```vue ``` 4. Happy phishing :) ## FAQ **Q**: I have an error `RangeError: Maximum call stack size exceeded`, how to solve it? **A**: This [issue described here](https://github.com/javascript-obfuscator/javascript-obfuscator/issues/89). To fix it, try to disable `splitStrings` in `obfuscator.js` or make smaller payload (it's recommended to use up to 2 MB payloads because of this issue). --- **Q**: Why does my payload build so long? **A**: The bigger payload you use, the longer it takes to create a JS file. To decrease time of build, try to disable `splitStrings` in `obfuscator.js`. Below is a table with estimated build times using default `obfuscator.js`. | Payload size | Build time | | --- | --- | | 525 KB | 53 s | | 1.25 MB | 8 m | | 3.59 MB | 25 m |