# Phishing Evasion Techniques - CDR Testing Guide

## Overview

This document explains the **6 different evasion techniques** used across the phishing test pages to test CDR detection capabilities. Each technique represents a real-world tactic used by attackers to bypass security controls.

---

## 📊 Current Coverage

| Site | Basic | Stealth | Image-Only | Delayed | Obfuscated | Multi-File | DOM-Built | Total |
|------|:-----:|:-------:|:----------:|:-------:|:----------:|:----------:|:---------:|:-----:|
| Google | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | **9** |
| Facebook | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | **7** |
| Microsoft | ✓ | ✓ | - | ✓ | - | - | - | **3** |
| Others (9 sites) | ✓ each | - | - | - | - | - | - | **9** |
| **TOTAL** | **12** | **3** | **2** | **3** | **2** | **2** | **2** | **28** |

---

## 🎯 Evasion Technique #1: **Stealth Titles**

### What It Is
Removes brand names from the `<title>` tag to avoid simple string matching.

### How It Works
```html
<!-- DETECTABLE -->
<title>Sign in - Google Accounts</title>

<!-- EVASIVE -->
<title>Sign in to your account</title>
<title>Secure Login</title>
<title>Account Access</title>
```

### Why Attackers Use It
- Evades simple title-based detection ("*Google*", "*PayPal*", etc.)
- More generic, less suspicious in bookmarks/history
- Harder to filter in email gateways

### What CDR Should Still Detect
- ✅ Logo analysis (SVG/image recognition)
- ✅ Form field patterns (email + password)
- ✅ CSS styling matching brand colors
- ✅ DOM structure similarities
- ✅ JavaScript patterns

### Files Using This Technique
- `Google/google_stealth.html` or `google_stealth_notitle.html`
- `Microsoft/microsoft_stealth.html`
- `Facebook/facebook_stealth.html`

---

## 🎯 Evasion Technique #2: **Image-Only Branding**

### What It Is
Brand names appear **only** in images/SVG - never as searchable text.

### How It Works
```html
<!-- DETECTABLE - Text in HTML -->
<h1>Google</h1>
<div class="logo">Microsoft</div>

<!-- EVASIVE - Image only -->
<img src="data:image/svg+xml;base64,..." alt="">
<div style="background-image:url(...)"></div>
```

### Why Attackers Use It
- Evades text-based content scanning
- OCR required to detect brand name
- Can't be found with grep/regex
- Bypasses keyword filters

### What CDR Should Still Detect
- ✅ Image analysis / OCR
- ✅ SVG content parsing
- ✅ Base64-decoded image analysis
- ✅ Form structure patterns
- ✅ Color scheme analysis

### Files Using This Technique
- `Google/google_image_only.html`
- `Facebook/facebook_image_only.html`

---

## 🎯 Evasion Technique #3: **Time-Delayed Loading**

### What It Is
Suspicious content loads **after** initial page scan completes.

### How It Works
```javascript
// Page initially shows:
<div id="loader">Loading...</div>

// After delay, dangerous content appears:
setTimeout(function() {
    document.getElementById('loader').style.display = 'none';
    document.getElementById('phishing-form').style.display = 'block';
}, 3000); // 3 second delay
```

### Why Attackers Use It
- Evades quick/initial content scans
- CDR scans at load time, then moves on
- Malicious content arrives "too late" to be scanned
- Looks like legitimate loading/AJAX

### What CDR Should Still Detect
- ✅ JavaScript analysis (scan all scripts)
- ✅ Hidden element inspection
- ✅ setTimeout/setInterval detection
- ✅ DOM mutation monitoring
- ✅ Full page re-scan after delays

### Delay Timings Used
- Google: 3000ms (3 seconds)
- Facebook: 2500ms (2.5 seconds)
- Microsoft: 2500ms (2.5 seconds)

### Files Using This Technique
- `Google/google_time_delayed.html` or `google_delayed.html`
- `Microsoft/microsoft_delayed.html`
- `Facebook/facebook_delayed.html`

---

## 🎯 Evasion Technique #4: **Obfuscated JavaScript**

### What It Is
JavaScript encoded with Base64 and executed via `eval(atob(...))`.

### How It Works
```javascript
// DETECTABLE - Plain JavaScript
form.addEventListener('submit', function(e) {
    harvestCredentials(e);
});

// EVASIVE - Base64 obfuscated
eval(atob('KGZ1bmN0aW9uKCl7dmFyIGY9ZG9jdW1lbnQucXVlc...'));
```

### Why Attackers Use It
- Hides malicious code from static analysis
- String matching fails (no "submit", "password", etc.)
- Requires JavaScript engine to decode
- Can layer multiple encodings

### What CDR Should Still Detect
- ✅ Detect `eval()` usage (red flag)
- ✅ Detect `atob()` (Base64 decode)
- ✅ Decode and analyze obfuscated code
- ✅ JavaScript sandbox execution
- ✅ Behavioral analysis

### Obfuscation Methods Used
- Base64 encoding (`atob()`)
- `eval()` execution
- Self-executing anonymous functions

### Files Using This Technique
- `Google/google_obfuscated.html`
- `Facebook/facebook_obfuscated.html`

---

## 🎯 Evasion Technique #5: **Multi-File Attacks**

### What It Is
Splits malicious content across **multiple files** (HTML + external CSS/JS).

### How It Works
```html
<!-- Main HTML (looks clean) -->
<html>
<head>
    <link rel="stylesheet" href="assets/style.css">
    <script src="assets/script.js"></script>
</head>
<body>
    <div id="app"></div>
</body>
</html>
```

```css
/* assets/style.css - Contains branding */
.logo::before {
    content: url(data:image/svg+xml;base64,...);
}
```

```javascript
// assets/script.js - Contains phishing logic
document.querySelector('form').addEventListener('submit', harvest);
```

### Why Attackers Use It
- Main HTML appears "clean"
- Malicious code in external files
- Tests if CDR scans **all** files or just HTML
- Bypasses single-file scanners

### What CDR Should Detect
- ✅ Scan ALL files, not just HTML
- ✅ Follow external resource references
- ✅ Analyze CSS (background images, content)
- ✅ Parse and analyze JavaScript files
- ✅ Reconstruct complete page from parts

### File Structure
```
Google/
├── google_multifile.html
└── assets/
    ├── google_style.css
    └── google_script.js
```

### Files Using This Technique
- `Google/google_multifile.html` + assets
- `Facebook/facebook_multifile.html` + assets

---

## 🎯 Evasion Technique #6: **DOM-Built Forms**

### What It Is
Form built **dynamically** via JavaScript - not present in initial HTML.

### How It Works
```html
<!-- Initial HTML (no form visible) -->
<html>
<body>
    <div id="app"></div>
</body>
</html>
```

```javascript
// JavaScript builds the form
var html = '<form action="#">';
html += '<input type="email" name="email">';
html += '<input type="password" name="password">';
html += '<button type="submit">Sign in</button>';
html += '</form>';

document.getElementById('app').innerHTML = html;
```

### Why Attackers Use It
- **No form in initial HTML source**
- Static HTML analysis finds nothing
- Requires JavaScript execution to see form
- Evades simple DOM parsers

### What CDR Should Detect
- ✅ Execute JavaScript to render full DOM
- ✅ Analyze dynamically created elements
- ✅ Detect `innerHTML` manipulation
- ✅ Monitor DOM mutations
- ✅ Full browser emulation/sandbox

### Implementation Details
- Form configuration stored in JSON
- `innerHTML` used to inject form
- Delays execution with `setTimeout()`
- Credentials handler added dynamically

### Files Using This Technique
- `Google/google_dom_built.html`
- `Facebook/facebook_dom_built.html`

---

## 🔍 Detection Matrix

| Evasion Technique | Static Scan | Title Match | Logo Match | JS Analysis | Full Render | Multi-File |
|-------------------|:-----------:|:-----------:|:----------:|:-----------:|:-----------:|:----------:|
| **1. Stealth Title** | ✓ | ✗ | ✓ | ✓ | ✓ | ✓ |
| **2. Image-Only** | ✗ | ✗ | ✓ (OCR) | ✓ | ✓ | ✓ |
| **3. Time-Delayed** | ✗ | ✗ | ✗ | ✓ | ✓ (wait) | ✓ |
| **4. Obfuscated JS** | ✗ | ✗ | ✓ | ✓ (decode) | ✓ | ✓ |
| **5. Multi-File** | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ (all files) |
| **6. DOM-Built** | ✗ | ✗ | ✗ | ✗ | ✓ (execute) | ✓ |

**Legend:**
- ✓ = Can detect with this method
- ✗ = Cannot detect with this method alone
- ✓ (note) = Can detect but requires additional capability

---

## 🛡️ CDR Detection Recommendations

### Level 1: Basic Detection (Fastest)
**What it catches:**
- Basic pages with brand names in title
- Simple HTML forms with logos
- Plain text brand references

**What it misses:**
- All 6 evasion techniques

**Coverage:** ~40% of phishing pages

---

### Level 2: Enhanced Detection (Recommended)
**Capabilities needed:**
- Static HTML analysis
- CSS parsing
- Logo/image analysis (OCR)
- JavaScript static analysis
- Multi-file scanning

**What it catches:**
- Stealth titles
- Image-only branding
- Obfuscated JavaScript (if decoded)
- Multi-file attacks

**What it misses:**
- Time-delayed loading
- DOM-built forms

**Coverage:** ~75% of phishing pages

---

### Level 3: Full Detection (Most Secure)
**Capabilities needed:**
- Full browser emulation (headless browser)
- JavaScript execution
- Wait for delays (3-5 seconds)
- DOM mutation monitoring
- Screenshot analysis
- Behavioral analysis

**What it catches:**
- **ALL 6 evasion techniques**

**Coverage:** ~95%+ of phishing pages

---

## 📋 Testing Your CDR

### Test Each Evasion Technique

**1. Stealth Titles**
```bash
# Should detect even without "Google" in title
test: Google/google_stealth.html
expect: Detected as phishing
expect: Brand identified: Google
```

**2. Image-Only Branding**
```bash
# Should extract brand from image
test: Google/google_image_only.html
expect: Detected as phishing
expect: Brand identified via OCR/image analysis
```

**3. Time-Delayed**
```bash
# Should wait and re-scan after delay
test: Google/google_delayed.html
expect: Detected as phishing
expect: Waited for content to load
expect: Form detected after delay
```

**4. Obfuscated JavaScript**
```bash
# Should decode Base64 and analyze
test: Google/google_obfuscated.html
expect: Detected as phishing
expect: JavaScript decoded and analyzed
expect: eval() flagged as suspicious
```

**5. Multi-File**
```bash
# Should scan ALL files
test: Google/google_multifile.html
expect: Detected as phishing
expect: External CSS scanned
expect: External JS scanned
expect: All files analyzed together
```

**6. DOM-Built**
```bash
# Should execute JS and inspect DOM
test: Google/google_dom_built.html
expect: Detected as phishing
expect: JavaScript executed
expect: Dynamically built form detected
```

---

## 🎯 Success Criteria

### Per-Technique Detection Rate

| Technique | Target | Acceptable | Poor |
|-----------|:------:|:----------:|:----:|
| Basic pages | 100% | 95%+ | <90% |
| Stealth titles | 100% | 90%+ | <80% |
| Image-only | 95% | 85%+ | <75% |
| Time-delayed | 90% | 80%+ | <70% |
| Obfuscated JS | 95% | 85%+ | <75% |
| Multi-file | 100% | 95%+ | <85% |
| DOM-built | 90% | 80%+ | <70% |

### Overall Detection Rate
- **Target:** 95%+ across all variations
- **Acceptable:** 90%+
- **Needs Improvement:** <90%

---

## 🔄 Real-World Attack Combinations

Attackers often **combine** multiple techniques:

### Combo 1: Stealth + Delayed
```html
<title>Loading...</title>
<script>
setTimeout(() => {
    // Load phishing form after 3s
}, 3000);
</script>
```

### Combo 2: Image-Only + Obfuscated
```html
<img src="data:image/svg+xml;base64,...">
<script>eval(atob('...'))</script>
```

### Combo 3: Multi-File + DOM-Built
```html
<link href="assets/style.css">
<script src="assets/builder.js"></script>
<!-- builder.js creates form dynamically -->
```

**Your CDR should detect ALL combinations!**

---

## 📈 Advancement Path

### Phase 1: Detect Basic Pages
- Simple title matching
- Logo recognition
- Form pattern detection

### Phase 2: Detect Simple Evasion
- Stealth titles
- Image-only branding
- Multi-file attacks

### Phase 3: Detect Advanced Evasion
- Time-delayed content
- JavaScript obfuscation
- DOM manipulation

### Phase 4: Detect Combinations
- Multiple evasion techniques together
- Novel/unknown evasion methods
- Zero-day phishing techniques

---

## 📊 Reporting Template

```
CDR Evasion Test Results
========================

Site: Google
Technique: Time-Delayed Loading
File: Google/google_delayed.html

Detection: [PASS / FAIL]
Time to detect: [X seconds]
Method used: [Static / Dynamic / Hybrid]
Brand identified: [Yes / No]
Confidence score: [0-100%]
Action taken: [Block / Sanitize / Warn]

Notes:
- Waited 3 seconds for content
- Form detected after delay
- Credentials fields logged
```

---

## ⚠️ Important Notes

### For Testers
- Test CDR with **all** variations, not just basic pages
- Measure detection rate per technique
- Time the analysis (speed vs. accuracy trade-off)
- Test in realistic conditions (email, web, file upload)

### For CDR Developers
- Don't rely on title matching alone
- Execute JavaScript when possible
- Wait for time-delayed content
- Scan ALL files in multi-file attacks
- Use behavioral analysis for DOM-built attacks

---

**End of Evasion Techniques Guide**

Generated: 2026-09-01  
Total Variations: 28 HTML files across 12 sites  
Evasion Techniques: 6 distinct methods  
Purpose: Comprehensive CDR testing