validator

Browser Target Validator

Pre-exploitation target validation for browser-based exploit chains. Confirms a target browser environment is genuine before signaling for payload delivery — rejecting honeypots, malware sandboxes, and security researcher VMs. All checks are passive read-only fingerprinting; no vulnerability is triggered and no data is exfiltrated.

Containment: Requires EXPLOIT_LAB_ACTIVE=1. All validation runs against the local lab browser session only.

Architecture

                    +---------------------+
                    |  validator-config   |
                    |  (YAML thresholds)  |
                    +----------+----------+
                               |
                               v
+--------+    +-----------+-----------+-----------+-----------+
| Browser | -> | Environ.  |  Debug    |  Target   |  Prior    |
| Context |    | Authentic.|  Detect.  |  Value    |  Compromise|
+--------+    +-----------+-----------+-----------+-----------+
                               |
                               v
                    +----------+----------+
                    |   GO / NO-GO        |
                    |   Decision Matrix   |
                    +---------------------+

The validator is a single ES module (validator.js) that runs entirely client-side in the browser. It performs read-only checks across five categories and returns a structured result object.

Components

1. Environment Authenticity

Detects honeypots, malware sandboxes, and automated analysis environments:

• navigator.webdriver flag (set by automation frameworks)
• Headless browser indicators (missing plugins, zero-dimension screens)
• Automation framework artifacts (__selenium_evaluate, __webdriver_evaluate, Playwright bindings)
• VM/sandbox indicators in WebGL renderer strings (VirtualBox, VMware, llvmpipe, SwiftShader)
• Low navigator.hardwareConcurrency (VMs typically expose 1-2 cores)
• Degraded performance.now() timer resolution (sandboxes reduce precision)

2. Debug Environment Detection

Detects instrumented analysis environments:

• DevTools open detection via window dimension differential
• Firebug presence (window.Firebug)
• SpiderMonkey debug build functions
• Browser instrumentation (coverage tools, profilers)
• Overridden console.log (common in analysis harnesses)

3. Target Value Assessment

Determines whether the target is worth engaging:

• Iframe embedding check (expected for Streamlit delivery on Databricks)
• Databricks workspace indicators (DOM elements, URL patterns, cookies)
• Cloud credential indicators in localStorage
• User interaction patterns (mouse movement, keyboard input - distinguishes real users from bots)

4. Existing Compromise Detection

Checks for evidence of prior exploitation:

• Custom markers from previous payload delivery
• SharedArrayBuffer availability (requires specific HTTP headers, indicates configured environment)
• Content Security Policy analysis via meta tags

5. Browser Version Fingerprinting

Precise target identification for payload selection:

• Browser engine and exact version via user agent and feature detection
• JIT compiler tier detection (V8 Turbofan / SpiderMonkey Ion activity)
• CPU architecture inference (x64 vs aarch64 via typed array alignment behavior)

Usage

import { validate } from './validator.js';

const result = await validate();

if (result.decision === 'GO') {
  // Target passes all checks - safe to proceed
  console.log('Target validated:', result.summary);
} else {
  // Abort - environment is a sandbox, honeypot, or out-of-scope target
  console.log('Validation failed:', result.failures);
}

Configuration

Edit validator-config.yaml to adjust thresholds, target criteria, and bypass rules.

Files

File	Purpose
validator.js	Core validation module (ES module)
validator-config.yaml	Threshold and targeting configuration
README.md	This file

References

Design informed by the Equation Group's DoubleFantasy and MistyVeal validator implants (Kaspersky GReAT, 2015; disclosed 2016-2017), adapted from host-level validation to browser-context validation for Databricks Apps.

• Kaspersky GReAT, "Equation Group: Questions and Answers" (2015)
• Countercept, DoublePulsar analysis (2017)
• MITRE ATT&CK: Gather Victim Host Information (T1592)