Infiltr8ForumGitHub
Edit

HTML Smuggling

MITRE ATT&CK™ Obfuscated Files or Information: HTML Smuggling - Technique T1027.006

Theory

We may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects.

When a target user opens the HTML in their web browser, the browser decodes the malicious payload, which, in turn, assembles the payload on the host device. Thus, instead of having a malicious executable pass directly through a network, the victime builds the malware locally behind a firewall.

Practice

First of, we need to base64 our payload.

Then, we can embed the output into the following example HTML / Javascript code

Resources

LogoObfuscated Files or Information: HTML Smuggling, Sub-technique T1027.006 - Enterprise | MITRE ATT&CK®attack.mitre.org
LogoFile Smuggling with HTML and JavaScript | Red Team Noteswww.ired.team
LogoHTML smuggling explained | OutflankOutflank

Last updated

Was this helpful?