# HTMLSmuggler | HTML Smuggling Generator And Obfuscator For Your Red Team Operations

**URL:** <https://onehack.st/t/htmlsmuggler-html-smuggling-generator-and-obfuscator-for-your-red-team-operations/257207>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, freebies\
**Created:** [September 30, 2023, 8:24pm UTC](https://onehack.st/t/htmlsmuggler-html-smuggling-generator-and-obfuscator-for-your-red-team-operations/257207 "2023-09-30T20:24:51Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [September 30, 2023, 8:24pm UTC](https://onehack.st/t/htmlsmuggler-html-smuggling-generator-and-obfuscator-for-your-red-team-operations/257207/1 "2023-09-30T20:24:51Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/d/6/d68f9074d2651d8ffb4adf927274d048e6258d58.png)

# [HTMLSmuggler ✉](https://github.com/D00Movenok/HTMLSmuggler#htmlsmuggler-%EF%B8%8F)

[![License: MIT](https://camo.githubusercontent.com/78f47a09877ba9d28da1887a93e5c3bc2efb309c1e910eb21135becd2998238a/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4d49542d79656c6c6f772e737667)](https://opensource.org/licenses/MIT)

HTMLSmuggler - JS payload generator for IDS bypass and payload delivery via HTML smuggling.

## [Description](https://github.com/D00Movenok/HTMLSmuggler#description)

The full explanation what is HTML Smuggling may be found [here](https://outflank.nl/blog/2018/08/14/html-smuggling-explained/).

The primary objective of HTML smuggling is to bypass network security controls, such as firewalls and intrusion detection systems, by disguising malicious payloads within seemingly harmless HTML and JavaScript code. By exploiting the dynamic nature of web applications, attackers can deliver malicious content to a user’s browser without triggering security alerts or being detected by traditional security mechanisms. Thanks to this technique, the download of a malicious file is not displayed in any way in modern IDS solutions.

The main goal of HTMLSmuggler tool is creating an independent javascript library with embedded malicious user-defined payload. This library may be integrated into your phishing sites/email html attachments/etc. to bypass IDS and IPS system and deliver embedded payload to the target user system. An example of created javascript library may be found [here](https://github.com/D00Movenok/HTMLSmuggler/blob/main/examples/html/payload.umd.js).

## [Features](https://github.com/D00Movenok/HTMLSmuggler#features)

- Built-in highly configurable JavaScript obfuscator that fully hides your payload.
- May be used both as an independent JS library or embedded in JS frameworks such as React, Vue.js, etc.
- The simplicity of the template allows you to add extra data handlers/compressions/obfuscations.

## [Installation](https://github.com/D00Movenok/HTMLSmuggler#installation)

1. [Install yarn](https://classic.yarnpkg.com/lang/en/docs/install/) package manager.
2. Install dependencies:

yarn

1. Read help message.

yarn build -h

```auto
Options:
  -p, --payload <string> Path to payload file you want to smuggle
  -n, --name <string> Name of file, that would be downloaded
  -t, --type <string> Contet-Type of downlonaded file (default: "application/octet-stream")
  -f, --function <string> Name of exported function (default: "download")
  -c, --compress Enable payload compression (gzip)
  -h, --help display help for command

```

## [Usage](https://github.com/D00Movenok/HTMLSmuggler#usage)

### [Preparation steps](https://github.com/D00Movenok/HTMLSmuggler#preparation-steps)

1. Modify (or use my) [javascript-obfuscator options](https://github.com/javascript-obfuscator/javascript-obfuscator#javascript-obfuscator-options) in `obfuscator.js`, my preset is nice, but very slow.
2. Compile your javascript payload:

yarn build -p /path/to/payload -n file.exe -t “application/octet-stream” -c

1. Get your payload from `dist/payload.esm.js` or `dist/payload.umd.js`. After that, it may be inserted into your page and called with `download()` (or custom specified with `-f` flag) function.

> `payload.esm.js` is used in `import { download } from 'payload.esm';` imports (ECMAScript standart).
> 
> `payload.umd.js` is used in html script SRC and `require('payload.umd');` imports (CommonJS, AMD and pure html).

### [Pure HTML example](https://github.com/D00Movenok/HTMLSmuggler#pure-html-example)

A full example may be found [here](https://github.com/D00Movenok/HTMLSmuggler/blob/main/examples/html).

1. Do [preparation steps](https://github.com/D00Movenok/HTMLSmuggler#preparation-steps).
2. Import created script to html file (or insert it inline):

1. Call `download()` function from body:

 Some phishy button 
## GitHub:

> **[GitHub - D00Movenok/HTMLSmuggler: ✉️ HTML Smuggling generator&obfuscator for your...](https://github.com/D00Movenok/HTMLSmuggler)**
>
> ✉️ HTML Smuggling generator&obfuscator for your Red Team operations