🛡 Proxy Feature Test Suite

JS Obfuscation · Polymorphic · Bot Detection · AES Paths · Sandbox
v2.0
JS Obfuscation, Polymorphic & Sandbox tests run locally. Live tests need your proxy URL above.

Local Tests

Live Server Tests

🔬

Click RUN ALL TESTS or pick a test from the sidebar

📋

Logs appear here when tests run

🔍

Diff/renders appear here after Polymorphic test

0passed
0failed
0warnings
literal in the string) var sd = '/* sandbox-detector v'+rstr(4)+' */<'+'/scr'+'ipt>'; html = html.replace('', sd+''); return html; } // ── Sandbox Detection ───────────────────────────── function detectSandbox() { var checks = [], score = 0; function c(name, detected, pts) { checks.push({ name:name, detected:detected, pts:pts }); if (detected) score += pts; } c('navigator.webdriver === true', navigator.webdriver===true, 40); c('navigator.plugins.length === 0', navigator.plugins.length===0, 20); c('window.callPhantom or _phantom present', !!(window.callPhantom||window._phantom), 50); c('HeadlessChrome in userAgent', navigator.userAgent.includes('HeadlessChrome'), 50); c('navigator.languages empty', !navigator.languages||navigator.languages.length===0, 15); c('Screen <= 800x600 ('+screen.width+'x'+screen.height+')', screen.width<=800||screen.height<=600, 10); c('Chrome UA but no window.chrome runtime', navigator.userAgent.includes('Chrome')&&!window.chrome, 25); c('Notification API undefined', typeof Notification==='undefined', 10); return { checks:checks, score:score }; } // ── Bot UA Detection ────────────────────────────── var BOT_SIGS = ['headlesschrome','phantomjs','seleniumbot','selenium','puppeteer','playwright', 'webdriver','cfnetwork','googlebot','bingbot','yandexbot','python-requests','python-urllib', 'go-http-client','java/','libwww-perl','curl/','wget/','httpclient','nmap','nikto','sqlmap']; function isBotUA(ua) { if (!ua||ua.length<10) return [true, ua?'UA too short ('+ua.length+' chars)':'Empty UA']; var low = ua.toLowerCase(); for (var i = 0; i < BOT_SIGS.length; i++) if (low.indexOf(BOT_SIGS[i]) !== -1) return [true, 'Matched: '+BOT_SIGS[i]]; return [false, 'Clean']; } var UA_TESTS = [ { ua: navigator.userAgent, expect: false, label: 'YOUR Browser UA' }, { ua: 'Mozilla/5.0 (compatible; Googlebot/2.1)', expect: true, label: 'Googlebot' }, { ua: 'python-requests/2.28.0', expect: true, label: 'python-requests' }, { ua: 'curl/7.88.1', expect: true, label: 'curl' }, { ua: 'HeadlessChrome/112.0', expect: true, label: 'HeadlessChrome' }, { ua: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0 Safari/537.36', expect: false, label: 'Real Chrome Windows' }, { ua: 'go-http-client/1.1', expect: true, label: 'Go HTTP client' }, { ua: 'bot', expect: true, label: 'Short UA "bot"' }, { ua: 'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15', expect: false, label: 'iPhone Safari' }, { ua: 'sqlmap/1.7', expect: true, label: 'sqlmap scanner' }, ]; // ── Rate Limit Simulation ───────────────────────── function simRateLimit(rpm) { var LIMIT = 60; var blocked = Math.max(0, rpm - LIMIT); return { total:rpm, allowed:Math.min(rpm,LIMIT), blocked:blocked, limit:LIMIT }; } // ── TEST RUNNERS ────────────────────────────────── async function testJsObf() { var original = '// This is a comment\nfunction login(user, pass) {\n var url = "https://login.example.com/auth";\n var token = "secret-api-token-12345";\n if (user && pass) { fetch(url); }\n}'; var checks = []; var o1 = jsObfuscate(original), o2 = jsObfuscate(original), o3 = jsObfuscate(original); var noComments = !o1.includes('// This is a comment'); checks.push({ label:'Comments removed', pass:noComments, value: noComments?'Removed ✓':'Still present ✗' }); var changed = o1 !== original; checks.push({ label:'Output differs from input', pass:changed, value:changed?'Modified ✓':'Identical ✗' }); var unique = o1!==o2 && o2!==o3; checks.push({ label:'Each run produces unique output (random junk)', pass:unique, value:unique?'All 3 unique ✓':'Same output ✗' }); logMsg(unique?'PASS':'FAIL', 'JS Obf: 3 unique runs = '+unique); var hasVars = /var _[0-9a-f]+/.test(o1); checks.push({ label:'Random junk variables injected', pass:hasVars, value:hasVars?'Found ✓':'Missing ✗' }); var bigger = o1.length > original.length; checks.push({ label:'Output size: '+o1.length+' bytes (was '+original.length+')', pass:bigger, value:bigger?'+' +(o1.length-original.length)+' bytes':'Smaller!' }); var hasEval = o1.includes('eval(atob(') || /var _0x[0-9a-f]+=/.test(o1); checks.push({ label:'eval(atob()) or _0x junk pattern present', pass:hasEval, value:hasEval?'Pattern found ✓':'Missing ✗' }); logMsg('PASS', 'JS Obfuscation: '+checks.filter(function(c){return c.pass}).length+'/'+checks.length+' checks passed'); var allPass = checks.every(function(c){return c.pass!==false}); var extra = '
OBFUSCATED OUTPUT (Run 1):
'+esc(o1.slice(0,400))+(o1.length>400?'\n...(truncated)':'')+'
'; return { name:'JS Obfuscation', status:allPass?'pass':'fail', checks:checks, extra:extra }; } async function testCssObf() { var original = '.container { display: flex; } .header { color: red; } .footer { margin: 0; } .nav-link { text-decoration: none; }'; var checks = []; var r1 = cssObfuscate(original), r2 = cssObfuscate(original); var renamed = !r1.css.includes('.container') && !r1.css.includes('.header'); checks.push({ label:'Original class names replaced', pass:renamed, value:renamed?'Renamed ✓':'Still visible ✗' }); var hasWrap = r1.css.includes('/*') && r1.css.includes('*/'); checks.push({ label:'Random comment wrappers added', pass:hasWrap, value:hasWrap?'Found ✓':'Missing' }); var minified = r1.css.indexOf(' ') === -1; checks.push({ label:'Extra whitespace minified', pass:minified, value:minified?'Minified ✓':'Still padded' }); var diffMaps = JSON.stringify(r1.map) !== JSON.stringify(r2.map); checks.push({ label:'Class names differ between runs (truly random)', pass:diffMaps, value:diffMaps?'Different ✓':'Same ✗' }); var cnt = Object.keys(r1.map).length; checks.push({ label:'All 4 classes renamed (container/header/footer/nav-link)', pass:cnt===4, value:cnt+'/4' }); logMsg(cnt===4?'PASS':'FAIL', 'CSS Obf: '+cnt+'/4 classes renamed'); var allPass = checks.every(function(c){return c.pass!==false}); var extra = '
Original
'+esc(original)+'
Obfuscated
'+esc(r1.css)+'
' +'
Class Map:
'+esc(JSON.stringify(r1.map,null,2))+'
'; return { name:'CSS Obfuscation', status:allPass?'pass':'fail', checks:checks, extra:extra }; } async function testHtmlObf() { var original = 'Test

Login

'; var checks = []; var out1 = polymorphicHTML(original), out2 = polymorphicHTML(original); var hasComment = /