Js obfuscation

JS Obfuscation & Anti-Detection

Professional-grade obfuscation pipeline for offensive JS payloads.

Architecture: Defense-in-Depth Layers

Request arrives
  │
  ├─ L1: Server-side cloaking (IP/ASN/GeoIP) → see anti-bot.md
  │   ├─ L2: CAPTCHA gate (Turnstile) → see anti-bot.md
  │   │   ├─ L3: JS anti-bot (webdriver, fingerprint, behavior) → see anti-bot.md
  │   │   │   ├─ L4: Encrypted payload (AES/XOR/Unicode) → see encryption.md
  │   │   │   │   └─ L5: Obfuscated JS (javascript-obfuscator) → see obfuscator-configs.md
  │   │   │   └─ L6: One-time URLs (single use, then 404)
  │   │   └─ Anti-DevTools → see anti-devtools.md

Without L1 everything else just delays detection. With L1, site can live weeks.

Quick Decision Guide

Scenario	Layers to apply
Quick red team page	L5 (obfuscator balanced) + anti-DevTools
Production phishing with longevity	All 6 layers
Landing page (BitB popup)	L3 (anti-bot) + L5 (obfuscator) + anti-DevTools
Cloudflare Worker	L1 (ASN via CF) + L4 (encrypted payload) + L5 (obfuscator)
Email attachment HTML	L4 (AES, key in URL fragment) + L5 (obfuscator max) + anti-DevTools

Safe Browsing Evasion Checklist

1. Server-side IP/ASN filter — crawlers never see payload
2. CAPTCHA gate — automated scanners can't solve
3. JS anti-bot — headless/sandbox detected and redirected
4. Encrypted payload — no static malicious HTML in source
5. Obfuscated JS — no signature matches (password, eval(atob( etc. hidden)
6. One-time URLs — reported link is already dead
7. Domain rotation — flagged → auto-switch to reserve
8. Delayed execution — setTimeout 3-5s, scanners have short budgets
9. Interaction-gated — require real click/scroll before payload
10. domainLock — code redirects on wrong domain (VirusTotal, sandbox)

Does NOT work: client-side blocking of safebrowsing.googleapis.com — checks happen at browser level before page JS.

VirusTotal / PhishTank Evasion

• No static signatures — all encrypted/dynamic
• CAPTCHA gating — crawlers can't solve
• One-time URLs — reported → 404
• Legit hosting (.workers.dev, .pages.dev, .netlify.app) = high reputation
• Aged domains (.com, 2+ years) flagged slower
• Email whitelist — only serve if email matches target list (Cephas pattern)
• domainLock in obfuscator — code breaks on wrong domain

Cloudflare WAF Compatibility

• No static malicious signatures — all encrypted/dynamic
• Use Turnstile — CF sees "protected site"
• Workers/Pages hosting gets less scrutiny
• Avoid trigger patterns: eval(atob(, obvious base64 HTML, known kit signatures
• Use RC4/AES instead of raw base64

What to Obfuscate vs Not

Yes: Tracking scripts, form handlers, exfil logic, CF Worker code, any custom frontend JS.

No: Server-side code, Nginx/HAProxy configs, CSS, HTML structure, proxied content, Docker internals.

One-Time URLs

active = {}

@app.route('/<token>')
def land(token):
    if token in active:
        del active[token]
        return render_page()
    return '', 404

Common Mistakes

1. Using only obfuscation without server-side filtering
2. base64 instead of RC4/AES — atob() is a detection signature
3. Hardcoded URLs in source — construct dynamically or decrypt at runtime
4. No domainLock — code runs on VirusTotal → flagged
5. renameGlobals: true without testing — breaks external scripts
6. Skipping mouse check — sandboxes bypass webdriver but don't move mouse
7. Static CAPTCHA — if cached forever, scanner reuses session
8. Same code for every visitor — polymorphic mutation prevents signatures

Reference Files

• obfuscator-configs.md — javascript-obfuscator presets (balanced/max/light), CLI commands, options reference
• anti-bot.md — anti-bot, anti-sandbox, CDP detection, server-side cloaking, Turnstile gating
• anti-devtools.md — 7 anti-DevTools methods, disable-devtool npm
• encryption.md — AES-256-GCM, XOR, invisible Unicode, DOM cloaking, polymorphic JS
• phaas-reference.md — 11 PhaaS kits (2025-2026), techniques by category, stats