SmuggleShield

Stable Version (2.2)

<br> <br> <a href="https://www.blackhat.com/asia-25/arsenal/schedule/#smuggleshield----basic-protection-against-html-smuggling-43154"> <img src="https://github.com/user-attachments/assets/316fa3e3-a840-43ba-811f-61caa1f79fd8" alt="SmuggleShield BlackHat" width="80" height="30"> </a>

SmuggleShield is a browser extension that aims to prevent HTML smuggling attacks by detecting common patterns. While this is not a comprehensive or bulletproof solution, it is an attempt to provide an additional layer of security during browsing or during your red/puprle team exercise.

The extension is compatible both on Chrome and Edge for Mac and Windows OS. Enable developer mode under extension settings and click on "Load unpacked" in the "SmuggleShiled" folder. The extension would be up and running. Blocked URLs are stored in extension cache up to 10 days with blocked pattern, URL, and timestamp, which can be reviewed by clicking on extension then "Export Blocked Content Logs", the current stable version also has key fatures such as "URL Whitelisting" because sometimes SmuggleShield could take few seconds extra to load a page, it scans every elements of the webpage but with this key feature (URL Whitelisting) you can reduce the overhead

Extension Workflow

Machine Learning Integration & Workflow

First, the HTMLSmugglingBlocker analyzes webpage content and combines both pattern-based detection and ML-based analysis. The MLDetector then extracts six key features (base64Length, blobUsage, downloadAttr, scriptDensity, encodingFunctions, binaryManipulation) and makes predictions using a 0.75 confidence threshold. Then its a continuous learning loop where the MLMonitor tracks performance metrics and feeds results back to improve detection accuracy, with all learned patterns persisted in chrome.storage.local for adaptation to new threats.

https://github.com/user-attachments/assets/8b8f1333-6a99-4979-bc17-56026a048ba8

In Action

https://github.com/user-attachments/assets/8d97fdcf-b3d2-4ddb-a846-0900e333b7fe

Loved by the Community

<table> <tr> <td> <a href="https://x.com/MalDevAcademy/status/1917240995399573838" target="_blank"> <img src="https://github.com/user-attachments/assets/7ac946a8-9ce2-453e-9bf5-a938b74806a9" alt="Tweet by @MalDevAcademy" width="400" style="border-radius: 6px; opacity: 0.9;" /> </a> </td> <td> <a href="https://x.com/MalDevAcademy/status/1927737455421030554" target="_blank"> <img src="https://github.com/user-attachments/assets/fd06745a-6e96-4f96-b3b2-ab697d2bab1c" alt="Screenshot" width="400" style="border-radius: 6px; opacity: 0.9;" /> </td> </tr> </table>

Incognito Mode Support

SmuggleShield can protect against HTML smuggling attempts in incognito mode, but requires manual activation. To enable incognito protection: open Chrome's extension management page (chrome://extensions/), click "Details" on SmuggleShield, and toggle "Allow in incognito". Note: This setting is disabled by default as per Chrome's security policy. When enabled, the extension will maintain separate states for normal and incognito sessions to preserve privacy, while providing the same level of protection against HTML smuggling attempts in both modes.

Whitelisting Note

Currently if you add any URLs in whitelisting (exception) it would still block the download in your current browser profile, but you would be able to download in incognito mode.

SmuggleShield Could Have Prevented

| Sr. No. | Details | Reference | |-------------|--------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------| | 1 | Shuckworm | X (Twitter) | | 2 | Quakbot campaign (14th July 2022) | GitHub | | 3 | DCRat malware via HTML Smuggling | X (Twitter) | | 4 | Pikabot (TA577, Version 1.1.15-ghost) | GitHub | | 5 | AsyncRAT delivered via malspam campaign | X (Twitter) |

Special Thanks

I have taken multiple code references from StackOverflow/Github and file smuggling samples from delivr[dot]to. Hence, special thanks to them!

Privacy Policy

Privacy Policy for SmuggleShield