CSSHide
is a tool for encoding a payload inside a mock-CSS file using CSS colour values with the aim of blending into common network traffic - Hiding in plain style.
![](https://raw.githubusercontent.com/Nuki2u/CSSHide/main/./images/CSSHide_logo.png)
C:\> git clone https://github.com/inb1ts/CSSHide.git
C:\> cd CSSHide
C:\> pip install rcssmin
C:\> python .\csshide.py --help
Supports two different formats of CSS colour attribute:
- rgb -
rgb(1 2 3)
- hex -
#ffffff
The payload is split into 3-byte chunks and encoded into these values before being placed amongst other randomly generated CSS attributes. There is an initial section of variables, as it allows us to encode a more concentrated portion of the payload straight away, before moving onto randomly-selected CSS selectors. The output can be minified to reduce size - as is occasionally done with legitimate CSS files - or left as the default format.
C:\>python.exe csshide.py -h
usage: csshide.py PAYLOAD_FILE [-h] [-f {rgb, hex}] [--no-minify] [-o OUT_FILE]
CSSHide encodes a payload in CSS colour values. Supports either rbg or hex CSS colour formats, and
minified/normal output.
positional arguments:
payload the payload file payload you want to encode
options:
-h, --help show this help message and exit
-s SELECTORS, --selectors SELECTORS
CSS selector wordlist
-f {rgb,hex}, --format {rgb,hex}
format of CSS color
--minify, --no-minify
minify output to save space (default: True)
-o OUTFILE, --outfile OUTFILE
name of output file to create
An example of fetching the CSS file from a server and decoding it in C (and using the WinAPI) can be found in the example_decode
directory.
csshide.py calc.bin
csshide.py calc.bin --no-minify
csshide.py calc.bin -f hex
csshide.py calc.bin -f hex --no-minify
- Size - Legitimate CSS files usually aren't too large, so whilst the tool will still work with a large payload (tested with Havoc agent shellcode of 95kb), the outputted file will look comically large for a CSS file and would definitely turn some heads.
- Limited selection of CSS properties and values - The randomised CSS properties and values are pulled from a hardcoded list that does not encompass all possible CSS properties.
- Can't currently blend between
rgb
andhex
formats - It's one or the other at the moment. - Doesn't currently utilise the alpha component of the
rgb
colour format - Predictably starts with the
root:
variable section, but would preferably randomise more elements at the start of the file such as font inclusions
- Shout out to Maldev Academy - the modules on payload encoding gave me the idea to try this.