git:20260726.137c488 to git:20260829.f957cc8

35 added, 54 removed. Audit A to A.

---

name: js-obfuscation

description: Use when obfuscating JavaScript, building anti-detection layers, evading Google Safe Browsing, hiding payloads from scanners, adding anti-bot/anti-DevTools protection, or preparing phishing/red-team pages for deployment

---

# JS Obfuscation & Anti-Detection

- Professional-grade obfuscation pipeline for offensive JS payloads.

## Architecture: Defense-in-Depth Layers

```

Request arrives

- │

- ├─ L1: Server-side cloaking (IP/ASN/GeoIP) → see anti-bot.md

- │ ├─ L2: CAPTCHA gate (Turnstile) → see anti-bot.md

- │ │ ├─ L3: JS anti-bot (webdriver, fingerprint, behavior) → see anti-bot.md

- │ │ │ ├─ L4: Encrypted payload (AES/XOR/Unicode) → see encryption.md

- │ │ │ │ └─ L5: Obfuscated JS (javascript-obfuscator) → see obfuscator-configs.md

+ ├─ L1: Server-side cloaking (IP/ASN/GeoIP) → anti-bot.md

+ │ ├─ L2: CAPTCHA gate (Turnstile) → anti-bot.md

+ │ │ ├─ L3: JS anti-bot (webdriver, fingerprint, behavior) → anti-bot.md

+ │ │ │ ├─ L4: Encrypted payload (AES/XOR/Unicode) → encryption.md

+ │ │ │ │ └─ L5: Obfuscated JS (javascript-obfuscator) → obfuscator-configs.md

│ │ │ └─ L6: One-time URLs (single use, then 404)

- │ │ └─ Anti-DevTools → see anti-devtools.md

+ │ │ └─ Anti-DevTools → anti-devtools.md

```

Without L1 everything else just delays detection. With L1, site can live weeks.

## Quick Decision Guide

- | Scenario | Layers to apply |

+ | Scenario | Layers |

|----------|----------------|

- | Quick red team page | L5 (obfuscator balanced) + anti-DevTools |

- | Production phishing with longevity | All 6 layers |

- | Landing page (BitB popup) | L3 (anti-bot) + L5 (obfuscator) + anti-DevTools |

- | Cloudflare Worker | L1 (ASN via CF) + L4 (encrypted payload) + L5 (obfuscator) |

- | Email attachment HTML | L4 (AES, key in URL fragment) + L5 (obfuscator max) + anti-DevTools |

+ | Quick red team page | L5 (balanced) + anti-DevTools |

+ | Production phishing with longevity | All 6 |

+ | Landing page (BitB popup) | L3 + L5 + anti-DevTools |

+ | Cloudflare Worker | L1 (ASN via CF) + L4 + L5 |

+ | Email attachment HTML | L4 (AES, key in URL fragment) + L5 (max) + anti-DevTools |

- ## Safe Browsing Evasion Checklist

+ ## Evasion Checklist (Safe Browsing / VirusTotal / PhishTank / CF WAF)

- 1. Server-side IP/ASN filter — crawlers never see payload

- 2. CAPTCHA gate — automated scanners can't solve

+ 1. Server-side IP/ASN/GeoIP filter — crawlers never see payload

+ 2. CAPTCHA gate (Turnstile) — scanners can't solve; CF sees "protected site"

3. JS anti-bot — headless/sandbox detected and redirected

- 4. Encrypted payload — no static malicious HTML in source

- 5. Obfuscated JS — no signature matches (`password`, `eval(atob(` etc. hidden)

- 6. One-time URLs — reported link is already dead

- 7. Domain rotation — flagged → auto-switch to reserve

- 8. Delayed execution — `setTimeout` 3-5s, scanners have short budgets

- 9. Interaction-gated — require real click/scroll before payload

- 10. `domainLock` — code redirects on wrong domain (VirusTotal, sandbox)

+ 4. Encrypted payload, RC4/AES — never raw base64, `atob()` is a detection signature

+ 5. Obfuscated JS — no `eval(atob(`, `password`, known-kit signatures in source

+ 6. `domainLock` — code breaks on wrong domain (VirusTotal, sandboxes)

+ 7. One-time URLs — reported link is already 404

+ 8. Domain rotation — flagged → reserve; aged domains (.com, 2+ years) flagged slower

+ 9. Delayed execution — `setTimeout` 3–5s; scanner budgets are short

+ 10. Interaction-gated — real click/scroll required before payload

+ 11. Polymorphic mutation — same code for every visitor → signatures

+ 12. Email whitelist (Cephas pattern) — serve only if email matches target list

+ 13. Legit hosting (`.workers.dev`, `.pages.dev`, `.netlify.app`) = high reputation; Workers/Pages get less scrutiny

Does NOT work: client-side blocking of `safebrowsing.googleapis.com` — checks happen at browser level before page JS.

- ## VirusTotal / PhishTank Evasion

- - No static signatures — all encrypted/dynamic

- - CAPTCHA gating — crawlers can't solve

- - One-time URLs — reported → 404

- - Legit hosting (`.workers.dev`, `.pages.dev`, `.netlify.app`) = high reputation

- - Aged domains (.com, 2+ years) flagged slower

- - Email whitelist — only serve if email matches target list (Cephas pattern)

- - `domainLock` in obfuscator — code breaks on wrong domain

- ## Cloudflare WAF Compatibility

- - No static malicious signatures — all encrypted/dynamic

- - Use Turnstile — CF sees "protected site"

- - Workers/Pages hosting gets less scrutiny

- - Avoid trigger patterns: `eval(atob(`, obvious base64 HTML, known kit signatures

- - Use RC4/AES instead of raw base64

- ## What to Obfuscate vs Not

- **Yes:** Tracking scripts, form handlers, exfil logic, CF Worker code, any custom frontend JS.

+ ## What to Obfuscate

- **No:** Server-side code, Nginx/HAProxy configs, CSS, HTML structure, proxied content, Docker internals.

+ **Yes:** tracking scripts, form handlers, exfil logic, CF Worker code, custom frontend JS.

+ **No:** server-side code, Nginx/HAProxy configs, CSS, HTML structure, proxied content, Docker internals.

## One-Time URLs

```python

active = {}

@app.route('/<token>')

def land(token):

if token in active:

del active[token]

return render_page()

return '', 404

```

## Common Mistakes

- 1. Using only obfuscation without server-side filtering

- 2. `base64` instead of RC4/AES — `atob()` is a detection signature

+ 1. Obfuscation without server-side filtering

+ 2. `base64` instead of RC4/AES — `atob()` is a signature

3. Hardcoded URLs in source — construct dynamically or decrypt at runtime

4. No `domainLock` — code runs on VirusTotal → flagged

5. `renameGlobals: true` without testing — breaks external scripts

- 6. Skipping mouse check — sandboxes bypass webdriver but don't move mouse

+ 6. No mouse check — sandboxes bypass webdriver but don't move mouse

7. Static CAPTCHA — if cached forever, scanner reuses session

8. Same code for every visitor — polymorphic mutation prevents signatures

## Reference Files

- - `obfuscator-configs.md` — javascript-obfuscator presets (balanced/max/light), CLI commands, options reference

- - `anti-bot.md` — anti-bot, anti-sandbox, CDP detection, server-side cloaking, Turnstile gating

- - `anti-devtools.md` — 7 anti-DevTools methods, disable-devtool npm

+ - `obfuscator-configs.md` — javascript-obfuscator presets (balanced/max/light), CLI, options

+ - `anti-bot.md` — anti-bot, anti-sandbox, CDP detection, server-side cloaking, Turnstile

+ - `anti-devtools.md` — 7 methods, disable-devtool npm

- `encryption.md` — AES-256-GCM, XOR, invisible Unicode, DOM cloaking, polymorphic JS

- - `phaas-reference.md` — 11 PhaaS kits (2025-2026), techniques by category, stats

+ - `phaas-reference.md` — 11 PhaaS kits (2025-2026), techniques, stats