Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1027.006_html-smuggling
Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files.
Passed 20 of 22 test cases with the skill, and 15 of 22 without it.
and 4 more in the full report
5 fixed15 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our security team wants to conduct a validation exercise for HTML smuggling defense capabilities using Atomic Red Team. Could you provide a structured execution guide for running the designated test file on a Windows system, including the required PowerShell execution command and any file dependency checks?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies executing the local HTML file directly in PowerShell using the ampersand invocation operator rather than invoking standard framework cmdlets | Missed | Passed |
| Identifies PathToAtomicsFolder\T1027.006\bin\T1027_006_Remote.html as the required dependency path | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1027
Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects. Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents. HTML5 also introduced a download attribute that may be used to initiate file downloads.
Adversaries may deliver payloads to victims that bypass security controls through HTML Smuggling by abusing JavaScript Blobs and/or HTML5 download attributes. Security controls such as web content filters may not identify smuggled malicious files inside of HTML/JS files, as the content may be based on typically benign MIME types such as text/plain and/or text/html. Malicious files or data can be obfuscated and hidden inside of HTML files through Data URLs and/or JavaScript Blobs and can be deobfuscated when they reach the victim (i.e. Deobfuscate/Decode Files or Information), potentially bypassing content filters.
For example, JavaScript Blobs can be abused to dynamically generate malicious files in the victim machine and may be dropped to disk by abusing JavaScript functions such as msSaveBlob.
Platforms: Windows, Linux, macOS
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
The HTML file will download an ISO file from T1553.005 without user interaction. The HTML file is based off of the work from Stan Hegt
Supported Platforms: windows
test cases passed, vs 15 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.