Skip to content

An implementation of the "Big Endian Obfuscation" Algorithm

License

Notifications You must be signed in to change notification settings

jmorganp/big-endian-obfuscator

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

10 Commits
 
 
 
 
 
 
 
 

Repository files navigation

Big Endian Obfuscator 💻

Description ℹ️:

An implementation of the "Big Endian Obfuscation" Algorithm, a javascript obfuscation algorithm which was discovered in the wild being used by threat actors in credential phishing campaigns to effectively evade anti-phishing bots and crawlers' detection. Used to obfuscate phishing page source code.

Snippet of obuscated HTML code 📃:

Obfuscated source

Steps taken to replicate 📝:

  • Reverse engineered JS code
  • Replicated algorithm
  • Optimized algorithm to reduce file output size (array literals)
  • Implemented JS code auto-generation in python

Usage ⚙️:

python bigendian.py

Phish detection and tracking ⚠️:

Description of Big and Little Endianness ℹ️:

Endianness is simply the order in which a sequence of bytes is stored in computer memory.

Endianness is primarily expressed as:

  • Big-endian (BE) 📉
  • Little-endian (LE) 📈.

In the Big endian system the most significant byte (the big end) in a sequence (word) is stored first at the lowest/smallest memory address and the least significant byte at the largest.

In contrast, in the Little endian system the least significant byte is stored first at the lowest/smallest memory address and the most significant byte at the largest.

Fun fact 😁:

The usage of the terms big endian and little endian were inspired by a passage in Gulliver's Travels (1726) in which the author used them to describe the two oppositions in a dispute on whether to crack a boiled egg by its big end or its little end.

About

An implementation of the "Big Endian Obfuscation" Algorithm

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages