An implementation of the "Big Endian Obfuscation" Algorithm, a javascript obfuscation algorithm which was discovered in the wild being used by threat actors in credential phishing campaigns to effectively evade anti-phishing bots and crawlers' detection. Used to obfuscate phishing page source code.

• Reverse engineered JS code
• Replicated algorithm
• Optimized algorithm to reduce file output size (array literals)
• Implemented JS code auto-generation in python

python bigendian.py

• Google Transparency Report
• PhishTank
• VirusTotal
• URLScan.io
• Norton Safe Web
• APWG

Endianness is simply the order in which a sequence of bytes is stored in computer memory.

• Big-endian (BE) 📉
• Little-endian (LE) 📈.

In the Big endian system the most significant byte (the big end) in a sequence (word) is stored first at the lowest/smallest memory address and the least significant byte at the largest.

In contrast, in the Little endian system the least significant byte is stored first at the lowest/smallest memory address and the most significant byte at the largest.

The usage of the terms big endian and little endian were inspired by a passage in Gulliver's Travels (1726) in which the author used them to describe the two oppositions in a dispute on whether to crack a boiled egg by its big end or its little end.