# Web Payload And Source-Code Playbook

Load this playbook for HTML, HTM, MHTML, SVG, XML, XSL, JavaScript, TypeScript, PHP, Python, Perl, Ruby, Lua, Node.js, JSP, ASP, ASPX, webshells, and source-code droppers.

## Tools

Preferred: `file`, hash tooling, `strings`, `rg`, `python3`, `xxd`, `base64`, `iconv`, `xmllint`, `sed`, `awk`, `tr`, `7z`, `exiftool`.

Useful: `node`, `php`, `perl`, `pwsh`, beautifiers, AST parsers, CyberChef CLI. Use runtimes only for parsing, formatting, AST extraction, or decoder emulation on inert data. Never execute the malicious payload as-is.

Ask before installing missing blocking tools.

## Workflow

1. Identify markup/language and embedded sub-languages.
2. Preserve original source and create normalized copies for analysis.
3. Beautify or unwrap minified code where useful without executing it.
4. Decode escaped, hex, percent-encoded, Base64, UTF-16, Unicode, compressed, concatenated, or mixed encodings.
5. Search browser/script primitives: `eval`, `Function`, `setTimeout`, `setInterval`, `unescape`, `atob`, `btoa`, `fromCharCode`, `Uint8Array`, `Blob`, `URL.createObjectURL`, `download`, `msSaveBlob`, hidden iframes, `meta refresh`, redirects, service workers, WebAssembly, and DOM injection.
6. Search Windows automation primitives: `ActiveXObject`, `WScript.Shell`, `CreateObject`, `MSXML2.XMLHTTP`, `WinHttpRequest`, `ADODB.Stream`, PowerShell, LOLBins.
7. Search server-side risk primitives: `exec`, `system`, `shell_exec`, `passthru`, `proc_open`, `popen`, `subprocess`, `os.system`, `child_process`, sockets, HTTP clients, upload/download handlers, auth gates, eval-like template injection, and outbound callbacks.
8. For HTML smuggling, reconstruct the generated payload bytes from JavaScript arrays, Base64, blobs, or DOM logic and save the artifact as a stage.
9. For webshells, identify authentication, command execution, file manager, upload/download, database access, callback, exfil, and persistence mechanisms.
10. Extract C2s, panels, drop URLs, stage URLs, webshell endpoints, credentials, tokens, API keys, and embedded payloads.
11. If remote retrieval is authorized, use the parent delivery logic exactly enough to retrieve safely in the lab and analyze the result as a new stage.

## Edge Cases And Anti-Loop Rules

- Follow the core Token Budget And Anti-Loop Mode.
- Never execute HTML, JavaScript, server-side code, webshells, generated payloads, or downloader logic directly.
- Save original, normalized, decoded, and generated artifacts separately.
- If parsing fails, switch to raw regex, AST with another tool, manual slicing, encoding-layer removal, or byte reconstruction.
- For HTML smuggling, verify generated bytes by file type and hashes before treating them as a stage.
- Classify URLs by usage context: callback, panel, fetch, redirect, library, decoy, or unknown.

## Report Requirements

Include language/markup type, delivery pattern, obfuscation chain, decoded payloads, webshell capabilities if present, C2/drop/stage URLs with origin, generated or downloaded stages with hashes, relevant code path, family/toolkit candidates, confidence, and limits.