New Twists for HTML Obfuscation in EEscan

Update 8/7/2007 - Please see www.eescan.net for additional details.

I've just finished coding up some new HTML obfuscation modules for eescan. The exploitability tests in eescan will use these obfuscators to probe for

Here are some of the obfuscators that work right now:

• gzip
• deflate
• chunked
• MPack XOR javascript encoder
• MPack cryptor 4-pass javascript encoder
  
• AJAX
• SSL
• HTTP over port 443
• SSL over port 80
  
• arbitrary combinations like AJAX->Mpack->gzip->chunked->SSL->port 80
  

My favorite so far is AJAX which breaks up the target html into a random number of arbitrary chunks, downloads each using a synchronous request, reassembles them and then eval()'s the code.

Initial testing of the Ajax modules is yielding great results against network based IDS/IPS, so-so results against proxies and good results against desktop AV/IPS suites.