Security Review of a Client-side Code Execution with HTML Smuggling Attack

The use of JavaScript and HTML5 is a technique that is widely employed in offensive security to smuggle malicious files past content filters. It is thus not a new approach. However, by considering novel techniques for antivirus evasion, this becomes a topic of high interest. We have also learned that many defenders (blue teams) are technically unaware of this mechanism and its implications. This combination has been incorporated into well-known frameworks that are offensive-related, such as SharpShooter and Demiguise, for example. The first tool is for retrieval and execution of arbitrary CSharp source code. It can also be used for creating payloads in various formats, including HTA, JS, VBS, and WSF. The second tool is aimed at generating. Html files that contain an encrypted HTA file. From our previous work, we have performed our research on the impact of Client-Side Code Execution with Microsoft Office” [1]. We have demonstrated several ways to obtain a reverse shell after a successful execution of a phishing attack. We also tested our malicious executable manually by downloading it and running it on a victim's machine (lab machine) before we performed the phishing activity. This worked well as an example, since nowadays, attackers often use very discreet delivery methods. Another example is by embedding a webpage in an email in a link format. When the victim opens the email and visits the link, JavaScript code will sneak the HTML code, hence HTML Smuggling, to automatically save the dropper file. This method leverages the HTML5 download attribute for anchor tags which tells the web browser to automatically download a file when a user clicks the defined hyperlink. This paper will focus primarily on the creation of the executable file and appliance of the parameters aforementioned using our attacker machine (Kali) and an Apache server.