Elvis Wiki - User contributions [en]

Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools

2026-01-23T12:27:42Z

YRahal:

== Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools ==
This project evaluates the effectiveness and practicality of browser-based cryptojacking detection and prevention tools in a controlled VM lab environment. The lab uses a Web VM that hosts test websites via nginx and a Victim VM that visits them using Firefox. The test set includes benign pages, CPU-heavy but legitimate pages, synthetic “miner-like” pages using a WebWorker (CPU load + optional periodic /ping requests), and a real cryptomining sample site.
The goal is to measure (1) whether each tool blocks miner-like or real mining activity, (2) whether it produces false positives on benign content, and (3) what exactly is blocked (script, domain/WebSocket endpoint, worker load, etc.), including detection latency.

== Setup ==

Host Machine: Windows with VirtualBox
Web VM (Ubuntu): nginx web server hosting the test pages
Victim VM (Ubuntu): Firefox browser used to access the pages
Network: Host-only network between the two VMs (example: 192.168.56.0/24)
Web VM IP: 192.168.56.10 (host-only interface)
Victim VM IP: 192.168.56.107 (host-only interface)
Web root (project): /var/www/crypto-test (nginx site: crypto-test)

=== Test pages (hosted by nginx) ===

benign.html — baseline normal page (no script)

heavy-benign.html — CPU-heavy but legitimate (stress false-positive test)

synthetic-miner.html — synthetic miner-like behavior (CPU-heavy WebWorker + optional /ping)

miner-known.html — synthetic miner-like page using known miner script name (signature test)

benign-coinhive-name.html — benign page that loads a coinhive-named script (name-based false-positive control)

monero-webminer/ — real cryptomining sample -> https://github.com/NajmAjmal/monero-webminer/tree/main

=== Scripts / worker variants ===

pow-worker.js — synthetic PoW-style workload (CPU-only; used by synthetic-miner.html)

coinhive.min.js — renamed/copy variant used as a “known miner signature” bait (used by miner-known.html)

coinhive.js — benign “coinhive-like name” control script (used by benign-coinhive-name.html)

script.js — real mining client script (used by monero-webminer/)

=== Tools being tested ===

MinerBlock

AdGuard

Malwarebytes

uBlock Origin

== Implementation ==

=== 1) Prepare connectivity between VMs ===

On Web VM: confirm IP address (ip a) and note host-only address (192.168.56.10)

On Victim VM: confirm IP address (ip a) and ensure it can reach the web VM:
** ping 192.168.56.10

=== 2) Host the test pages on the Web VM (nginx) ===

Confirm the nginx site root used for this project:
** grep -R "root " /etc/nginx/sites-enabled/ /etc/nginx/sites-available/ | head

Place pages and scripts under the configured root (example: /var/www/crypto-test)

Confirm each page is reachable from the Victim VM:
** curl -I http://192.168.56.10/benign.html

** curl -I http://192.168.56.10/heavy-benign.html

** curl -I http://192.168.56.10/synthetic-miner.html

** curl -I http://192.168.56.10/miner-known.html

** curl -I http://192.168.56.10/benign-coinhive-name.html

** curl -I http://192.168.56.10/monero-webminer/

=== 3) Measurement procedure (repeatable) ===
Each tool is tested against each page with the same procedure:

Open a Private Window (or clear cache/site data between runs)

Open DevTools → Network, enable “Disable cache”

Load the page (Ctrl+Shift+R to force reload)

If the page has Start/Stop controls, click Start and observe:
** Blocked? (Y/N)
** Detection latency (approx. seconds or measured via timestamps)
** False positive? (Y/N) for benign and heavy-benign and benign-coinhive-name
** What was blocked (script URL, worker load, domain/WebSocket endpoint, host)

Capture evidence screenshots

=== 4) data collection ===

* [[Media:Cryptojacking_experiment_Screenshots_compressed.pdf|Screenshots (PDF)]]

== Results ==

[[File:Restults Screenshot.png|thumb|900px|Results table for all tools and test pages.]]

Baseline benign pages (benign.html, heavy-benign.html) loaded normally for all tools tested (no false positives observed in initial pass).

Name-based control (benign-coinhive-name.html using coinhive.js) was not blocked in the initial pass for most tools, indicating that simple substring matching is not universal; however, signature-like names can still trigger blocking depending on the exact filename/list.

Synthetic miner (synthetic-miner.html using pow-worker.js) was not blocked by several tools in the initial pass, suggesting limited behavioral detection for purely CPU-based worker workloads.

Known-signature miner (miner-known.html using coinhive.min.js) was blocked by tools that rely on known miner indicators/lists; the block was visible as a blocked script request and/or extension UI warning.

Real mining sample (monero-webminer/) produced WebSocket connections to an external endpoint (101 Switching Protocols) when not blocked; some tools blocked the mining client script and prevented mining from starting, while others did not detect it in the initial pass.

[[Category:Documentation]]

Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools

2026-01-23T12:20:11Z

YRahal: /* Results */

== Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools ==
This project evaluates the effectiveness and practicality of browser-based cryptojacking detection and prevention tools in a controlled VM lab environment. The lab uses a Web VM that hosts test websites via nginx and a Victim VM that visits them using Firefox. The test set includes benign pages, CPU-heavy but legitimate pages, synthetic “miner-like” pages using a WebWorker (CPU load + optional periodic /ping requests), and a real cryptomining sample site.
The goal is to measure (1) whether each tool blocks miner-like or real mining activity, (2) whether it produces false positives on benign content, and (3) what exactly is blocked (script, domain/WebSocket endpoint, worker load, etc.), including detection latency and resource impact.

== Setup ==

Host Machine: Windows with VirtualBox
Web VM (Ubuntu): nginx web server hosting the test pages
Victim VM (Ubuntu): Firefox browser used to access the pages
Network: Host-only network between the two VMs (example: 192.168.56.0/24)
Web VM IP: 192.168.56.10 (host-only interface)
Victim VM IP: 192.168.56.107 (host-only interface)
Web root (project): /var/www/crypto-test (nginx site: crypto-test)

=== Test pages (hosted by nginx) ===

benign.html — baseline normal page (no script)

heavy-benign.html — CPU-heavy but legitimate (stress false-positive test)

synthetic-miner.html — synthetic miner-like behavior (CPU-heavy WebWorker + optional /ping)

miner-known.html — synthetic miner-like page using known miner script name (signature test)

benign-coinhive-name.html — benign page that loads a coinhive-named script (name-based false-positive control)

monero-webminer/ — real cryptomining sample -> https://github.com/NajmAjmal/monero-webminer/tree/main

=== Scripts / worker variants ===

pow-worker.js — synthetic PoW-style workload (CPU-only; used by synthetic-miner.html)

coinhive.min.js — renamed/copy variant used as a “known miner signature” bait (used by miner-known.html)

coinhive.js — benign “coinhive-like name” control script (used by benign-coinhive-name.html)

script.js — real mining client script (used by monero-webminer/)

=== Tools being tested ===

MinerBlock

AdGuard

Malwarebytes

uBlock Origin

== Implementation ==

=== 1) Prepare connectivity between VMs ===

On Web VM: confirm IP address (ip a) and note host-only address (192.168.56.10)

On Victim VM: confirm IP address (ip a) and ensure it can reach the web VM:
** ping 192.168.56.10

=== 2) Host the test pages on the Web VM (nginx) ===

Confirm the nginx site root used for this project:
** grep -R "root " /etc/nginx/sites-enabled/ /etc/nginx/sites-available/ | head

Place pages and scripts under the configured root (example: /var/www/crypto-test)

Confirm each page is reachable from the Victim VM:
** curl -I http://192.168.56.10/benign.html

** curl -I http://192.168.56.10/heavy-benign.html

** curl -I http://192.168.56.10/synthetic-miner.html

** curl -I http://192.168.56.10/miner-known.html

** curl -I http://192.168.56.10/benign-coinhive-name.html

** curl -I http://192.168.56.10/monero-webminer/

=== 3) Measurement procedure (repeatable) ===
Each tool is tested against each page with the same procedure:

Open a Private Window (or clear cache/site data between runs)

Open DevTools → Network, enable “Disable cache”

Load the page (Ctrl+Shift+R to force reload)

If the page has Start/Stop controls, click Start and observe:
** Blocked? (Y/N)
** Detection latency (approx. seconds or measured via timestamps)
** False positive? (Y/N) for benign and heavy-benign and benign-coinhive-name
** What was blocked (script URL, worker load, domain/WebSocket endpoint, host)

Capture evidence screenshots

=== 4) data collection ===

* [[Media:Cryptojacking_experiment_Screenshots_compressed.pdf|Screenshots (PDF)]]

== Results ==

[[File:Restults Screenshot.png|thumb|900px|Results table for all tools and test pages.]]

Baseline benign pages (benign.html, heavy-benign.html) loaded normally for all tools tested (no false positives observed in initial pass).

Name-based control (benign-coinhive-name.html using coinhive.js) was not blocked in the initial pass for most tools, indicating that simple substring matching is not universal; however, signature-like names can still trigger blocking depending on the exact filename/list.

Synthetic miner (synthetic-miner.html using pow-worker.js) was not blocked by several tools in the initial pass, suggesting limited behavioral detection for purely CPU-based worker workloads.

Known-signature miner (miner-known.html using coinhive.min.js) was blocked by tools that rely on known miner indicators/lists; the block was visible as a blocked script request and/or extension UI warning.

Real mining sample (monero-webminer/) produced WebSocket connections to an external endpoint (101 Switching Protocols) when not blocked; some tools blocked the mining client script and prevented mining from starting, while others did not detect it in the initial pass.

[[Category:Documentation]]

Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools

2026-01-23T12:17:45Z

YRahal: /* Results */

== Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools ==
This project evaluates the effectiveness and practicality of browser-based cryptojacking detection and prevention tools in a controlled VM lab environment. The lab uses a Web VM that hosts test websites via nginx and a Victim VM that visits them using Firefox. The test set includes benign pages, CPU-heavy but legitimate pages, synthetic “miner-like” pages using a WebWorker (CPU load + optional periodic /ping requests), and a real cryptomining sample site.
The goal is to measure (1) whether each tool blocks miner-like or real mining activity, (2) whether it produces false positives on benign content, and (3) what exactly is blocked (script, domain/WebSocket endpoint, worker load, etc.), including detection latency and resource impact.

== Setup ==

Host Machine: Windows with VirtualBox
Web VM (Ubuntu): nginx web server hosting the test pages
Victim VM (Ubuntu): Firefox browser used to access the pages
Network: Host-only network between the two VMs (example: 192.168.56.0/24)
Web VM IP: 192.168.56.10 (host-only interface)
Victim VM IP: 192.168.56.107 (host-only interface)
Web root (project): /var/www/crypto-test (nginx site: crypto-test)

=== Test pages (hosted by nginx) ===

benign.html — baseline normal page (no script)

heavy-benign.html — CPU-heavy but legitimate (stress false-positive test)

synthetic-miner.html — synthetic miner-like behavior (CPU-heavy WebWorker + optional /ping)

miner-known.html — synthetic miner-like page using known miner script name (signature test)

benign-coinhive-name.html — benign page that loads a coinhive-named script (name-based false-positive control)

monero-webminer/ — real cryptomining sample -> https://github.com/NajmAjmal/monero-webminer/tree/main

=== Scripts / worker variants ===

pow-worker.js — synthetic PoW-style workload (CPU-only; used by synthetic-miner.html)

coinhive.min.js — renamed/copy variant used as a “known miner signature” bait (used by miner-known.html)

coinhive.js — benign “coinhive-like name” control script (used by benign-coinhive-name.html)

script.js — real mining client script (used by monero-webminer/)

=== Tools being tested ===

MinerBlock

AdGuard

Malwarebytes

uBlock Origin

== Implementation ==

=== 1) Prepare connectivity between VMs ===

On Web VM: confirm IP address (ip a) and note host-only address (192.168.56.10)

On Victim VM: confirm IP address (ip a) and ensure it can reach the web VM:
** ping 192.168.56.10

=== 2) Host the test pages on the Web VM (nginx) ===

Confirm the nginx site root used for this project:
** grep -R "root " /etc/nginx/sites-enabled/ /etc/nginx/sites-available/ | head

Place pages and scripts under the configured root (example: /var/www/crypto-test)

Confirm each page is reachable from the Victim VM:
** curl -I http://192.168.56.10/benign.html

** curl -I http://192.168.56.10/heavy-benign.html

** curl -I http://192.168.56.10/synthetic-miner.html

** curl -I http://192.168.56.10/miner-known.html

** curl -I http://192.168.56.10/benign-coinhive-name.html

** curl -I http://192.168.56.10/monero-webminer/

=== 3) Measurement procedure (repeatable) ===
Each tool is tested against each page with the same procedure:

Open a Private Window (or clear cache/site data between runs)

Open DevTools → Network, enable “Disable cache”

Load the page (Ctrl+Shift+R to force reload)

If the page has Start/Stop controls, click Start and observe:
** Blocked? (Y/N)
** Detection latency (approx. seconds or measured via timestamps)
** False positive? (Y/N) for benign and heavy-benign and benign-coinhive-name
** What was blocked (script URL, worker load, domain/WebSocket endpoint, host)

Capture evidence screenshots

=== 4) data collection ===

* [[Media:Cryptojacking_experiment_Screenshots_compressed.pdf|Screenshots (PDF)]]

== Results ==

* [[Media:Results Screenshot.png|Results table (PNG)]]

Baseline benign pages (benign.html, heavy-benign.html) loaded normally for all tools tested (no false positives observed in initial pass).

Name-based control (benign-coinhive-name.html using coinhive.js) was not blocked in the initial pass for most tools, indicating that simple substring matching is not universal; however, signature-like names can still trigger blocking depending on the exact filename/list.

Synthetic miner (synthetic-miner.html using pow-worker.js) was not blocked by several tools in the initial pass, suggesting limited behavioral detection for purely CPU-based worker workloads.

Known-signature miner (miner-known.html using coinhive.min.js) was blocked by tools that rely on known miner indicators/lists; the block was visible as a blocked script request and/or extension UI warning.

Real mining sample (monero-webminer/) produced WebSocket connections to an external endpoint (101 Switching Protocols) when not blocked; some tools blocked the mining client script and prevented mining from starting, while others did not detect it in the initial pass.

[[Category:Documentation]]

Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools

2026-01-23T12:16:30Z

YRahal:

== Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools ==
This project evaluates the effectiveness and practicality of browser-based cryptojacking detection and prevention tools in a controlled VM lab environment. The lab uses a Web VM that hosts test websites via nginx and a Victim VM that visits them using Firefox. The test set includes benign pages, CPU-heavy but legitimate pages, synthetic “miner-like” pages using a WebWorker (CPU load + optional periodic /ping requests), and a real cryptomining sample site.
The goal is to measure (1) whether each tool blocks miner-like or real mining activity, (2) whether it produces false positives on benign content, and (3) what exactly is blocked (script, domain/WebSocket endpoint, worker load, etc.), including detection latency and resource impact.

== Setup ==

Host Machine: Windows with VirtualBox
Web VM (Ubuntu): nginx web server hosting the test pages
Victim VM (Ubuntu): Firefox browser used to access the pages
Network: Host-only network between the two VMs (example: 192.168.56.0/24)
Web VM IP: 192.168.56.10 (host-only interface)
Victim VM IP: 192.168.56.107 (host-only interface)
Web root (project): /var/www/crypto-test (nginx site: crypto-test)

=== Test pages (hosted by nginx) ===

benign.html — baseline normal page (no script)

heavy-benign.html — CPU-heavy but legitimate (stress false-positive test)

synthetic-miner.html — synthetic miner-like behavior (CPU-heavy WebWorker + optional /ping)

miner-known.html — synthetic miner-like page using known miner script name (signature test)

benign-coinhive-name.html — benign page that loads a coinhive-named script (name-based false-positive control)

monero-webminer/ — real cryptomining sample -> https://github.com/NajmAjmal/monero-webminer/tree/main

=== Scripts / worker variants ===

pow-worker.js — synthetic PoW-style workload (CPU-only; used by synthetic-miner.html)

coinhive.min.js — renamed/copy variant used as a “known miner signature” bait (used by miner-known.html)

coinhive.js — benign “coinhive-like name” control script (used by benign-coinhive-name.html)

script.js — real mining client script (used by monero-webminer/)

=== Tools being tested ===

MinerBlock

AdGuard

Malwarebytes

uBlock Origin

== Implementation ==

=== 1) Prepare connectivity between VMs ===

On Web VM: confirm IP address (ip a) and note host-only address (192.168.56.10)

On Victim VM: confirm IP address (ip a) and ensure it can reach the web VM:
** ping 192.168.56.10

=== 2) Host the test pages on the Web VM (nginx) ===

Confirm the nginx site root used for this project:
** grep -R "root " /etc/nginx/sites-enabled/ /etc/nginx/sites-available/ | head

Place pages and scripts under the configured root (example: /var/www/crypto-test)

Confirm each page is reachable from the Victim VM:
** curl -I http://192.168.56.10/benign.html

** curl -I http://192.168.56.10/heavy-benign.html

** curl -I http://192.168.56.10/synthetic-miner.html

** curl -I http://192.168.56.10/miner-known.html

** curl -I http://192.168.56.10/benign-coinhive-name.html

** curl -I http://192.168.56.10/monero-webminer/

=== 3) Measurement procedure (repeatable) ===
Each tool is tested against each page with the same procedure:

Open a Private Window (or clear cache/site data between runs)

Open DevTools → Network, enable “Disable cache”

Load the page (Ctrl+Shift+R to force reload)

If the page has Start/Stop controls, click Start and observe:
** Blocked? (Y/N)
** Detection latency (approx. seconds or measured via timestamps)
** False positive? (Y/N) for benign and heavy-benign and benign-coinhive-name
** What was blocked (script URL, worker load, domain/WebSocket endpoint, host)

Capture evidence screenshots

=== 4) data collection ===

* [[Media:Cryptojacking_experiment_Screenshots_compressed.pdf|Screenshots (PDF)]]

== Results ==

* [[Media:Results_Screenshot.png|Results table (PNG)]]

Baseline benign pages (benign.html, heavy-benign.html) loaded normally for all tools tested (no false positives observed in initial pass).

Name-based control (benign-coinhive-name.html using coinhive.js) was not blocked in the initial pass for most tools, indicating that simple substring matching is not universal; however, signature-like names can still trigger blocking depending on the exact filename/list.

Synthetic miner (synthetic-miner.html using pow-worker.js) was not blocked by several tools in the initial pass, suggesting limited behavioral detection for purely CPU-based worker workloads.

Known-signature miner (miner-known.html using coinhive.min.js) was blocked by tools that rely on known miner indicators/lists; the block was visible as a blocked script request and/or extension UI warning.

Real mining sample (monero-webminer/) produced WebSocket connections to an external endpoint (101 Switching Protocols) when not blocked; some tools blocked the mining client script and prevented mining from starting, while others did not detect it in the initial pass.

[[Category:Documentation]]

Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools

2026-01-23T12:14:50Z

YRahal:

== Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools ==
This project evaluates the effectiveness and practicality of browser-based cryptojacking detection and prevention tools in a controlled VM lab environment. The lab uses a Web VM that hosts test websites via nginx and a Victim VM that visits them using Firefox. The test set includes benign pages, CPU-heavy but legitimate pages, synthetic “miner-like” pages using a WebWorker (CPU load + optional periodic /ping requests), and a real cryptomining sample site.
The goal is to measure (1) whether each tool blocks miner-like or real mining activity, (2) whether it produces false positives on benign content, and (3) what exactly is blocked (script, domain/WebSocket endpoint, worker load, etc.), including detection latency and resource impact.

== Setup ==

Host Machine: Windows with VirtualBox
Web VM (Ubuntu): nginx web server hosting the test pages
Victim VM (Ubuntu): Firefox browser used to access the pages
Network: Host-only network between the two VMs (example: 192.168.56.0/24)
Web VM IP: 192.168.56.10 (host-only interface)
Victim VM IP: 192.168.56.107 (host-only interface)
Web root (project): /var/www/crypto-test (nginx site: crypto-test)

=== Test pages (hosted by nginx) ===

benign.html — baseline normal page (no script)

heavy-benign.html — CPU-heavy but legitimate (stress false-positive test)

synthetic-miner.html — synthetic miner-like behavior (CPU-heavy WebWorker + optional /ping)

miner-known.html — synthetic miner-like page using known miner script name (signature test)

benign-coinhive-name.html — benign page that loads a coinhive-named script (name-based false-positive control)

monero-webminer/ — real cryptomining sample -> https://github.com/NajmAjmal/monero-webminer/tree/main

=== Scripts / worker variants ===

pow-worker.js — synthetic PoW-style workload (CPU-only; used by synthetic-miner.html)

coinhive.min.js — renamed/copy variant used as a “known miner signature” bait (used by miner-known.html)

coinhive.js — benign “coinhive-like name” control script (used by benign-coinhive-name.html)

script.js — real mining client script (used by monero-webminer/)

=== Tools being tested ===

MinerBlock

AdGuard

Malwarebytes

uBlock Origin

== Implementation ==

=== 1) Prepare connectivity between VMs ===

On Web VM: confirm IP address (ip a) and note host-only address (192.168.56.10)

On Victim VM: confirm IP address (ip a) and ensure it can reach the web VM:
** ping 192.168.56.10

=== 2) Host the test pages on the Web VM (nginx) ===

Confirm the nginx site root used for this project:
** grep -R "root " /etc/nginx/sites-enabled/ /etc/nginx/sites-available/ | head

Place pages and scripts under the configured root (example: /var/www/crypto-test)

Confirm each page is reachable from the Victim VM:
** curl -I http://192.168.56.10/benign.html

** curl -I http://192.168.56.10/heavy-benign.html

** curl -I http://192.168.56.10/synthetic-miner.html

** curl -I http://192.168.56.10/miner-known.html

** curl -I http://192.168.56.10/benign-coinhive-name.html

** curl -I http://192.168.56.10/monero-webminer/

=== 3) Measurement procedure (repeatable) ===
Each tool is tested against each page with the same procedure:

Open a Private Window (or clear cache/site data between runs)

Open DevTools → Network, enable “Disable cache”

Load the page (Ctrl+Shift+R to force reload)

If the page has Start/Stop controls, click Start and observe:
** Blocked? (Y/N)
** Detection latency (approx. seconds or measured via timestamps)
** False positive? (Y/N) for benign and heavy-benign and benign-coinhive-name
** What was blocked (script URL, worker load, domain/WebSocket endpoint, host)

Capture evidence screenshots

=== 4) data collection ===
Pages:

* [[Media:Cryptojacking_experiment_Screenshots_compressed.pdf|Screenshots (PDF)]]

== Results So Far (initial run) ==

Baseline benign pages (benign.html, heavy-benign.html) loaded normally for all tools tested (no false positives observed in initial pass).

Name-based control (benign-coinhive-name.html using coinhive.js) was not blocked in the initial pass for most tools, indicating that simple substring matching is not universal; however, signature-like names can still trigger blocking depending on the exact filename/list.

Synthetic miner (synthetic-miner.html using pow-worker.js) was not blocked by several tools in the initial pass, suggesting limited behavioral detection for purely CPU-based worker workloads.

Known-signature miner (miner-known.html using coinhive.min.js) was blocked by tools that rely on known miner indicators/lists; the block was visible as a blocked script request and/or extension UI warning.

Real mining sample (monero-webminer/) produced WebSocket connections to an external endpoint (101 Switching Protocols) when not blocked; some tools blocked the mining client script and prevented mining from starting, while others did not detect it in the initial pass.

[[Category:Documentation]]

File:Restults Screenshot.png

2026-01-23T12:13:23Z

YRahal: Screenshots of the results of the experement that has been done

== Summary ==
Screenshots of the results of the experement that has been done

File:Cryptojacking experiment Screenshots compressed.pdf

2026-01-23T12:11:05Z

YRahal: Screenshots of the experement that has been done

== Summary ==
Screenshots of the experement that has been done

Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools

2026-01-23T12:08:53Z

YRahal:

== Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools ==
This project evaluates the effectiveness and practicality of browser-based cryptojacking detection and prevention tools in a controlled VM lab environment. The lab uses a Web VM that hosts test websites via nginx and a Victim VM that visits them using Firefox. The test set includes benign pages, CPU-heavy but legitimate pages, synthetic “miner-like” pages using a WebWorker (CPU load + optional periodic /ping requests), and a real cryptomining sample site.
The goal is to measure (1) whether each tool blocks miner-like or real mining activity, (2) whether it produces false positives on benign content, and (3) what exactly is blocked (script, domain/WebSocket endpoint, worker load, etc.), including detection latency and resource impact.

== Setup ==

Host Machine: Windows with VirtualBox
Web VM (Ubuntu): nginx web server hosting the test pages
Victim VM (Ubuntu): Firefox browser used to access the pages
Network: Host-only network between the two VMs (example: 192.168.56.0/24)
Web VM IP: 192.168.56.10 (host-only interface)
Victim VM IP: 192.168.56.107 (host-only interface)
Web root (project): /var/www/crypto-test (nginx site: crypto-test)

=== Test pages (hosted by nginx) ===

benign.html — baseline normal page (no script)

heavy-benign.html — CPU-heavy but legitimate (stress false-positive test)

synthetic-miner.html — synthetic miner-like behavior (CPU-heavy WebWorker + optional /ping)

miner-known.html — synthetic miner-like page using known miner script name (signature test)

benign-coinhive-name.html — benign page that loads a coinhive-named script (name-based false-positive control)

monero-webminer/ — real cryptomining sample -> https://github.com/NajmAjmal/monero-webminer/tree/main

=== Scripts / worker variants ===

pow-worker.js — synthetic PoW-style workload (CPU-only; used by synthetic-miner.html)

coinhive.min.js — renamed/copy variant used as a “known miner signature” bait (used by miner-known.html)

coinhive.js — benign “coinhive-like name” control script (used by benign-coinhive-name.html)

script.js — real mining client script (used by monero-webminer/)

=== Tools being tested ===

MinerBlock

AdGuard

Malwarebytes

uBlock Origin

== Implementation ==

=== 1) Prepare connectivity between VMs ===

On Web VM: confirm IP address (ip a) and note host-only address (192.168.56.10)

On Victim VM: confirm IP address (ip a) and ensure it can reach the web VM:
** ping 192.168.56.10

=== 2) Host the test pages on the Web VM (nginx) ===

Confirm the nginx site root used for this project:
** grep -R "root " /etc/nginx/sites-enabled/ /etc/nginx/sites-available/ | head

Place pages and scripts under the configured root (example: /var/www/crypto-test)

Confirm each page is reachable from the Victim VM:
** curl -I http://192.168.56.10/benign.html

** curl -I http://192.168.56.10/heavy-benign.html

** curl -I http://192.168.56.10/synthetic-miner.html

** curl -I http://192.168.56.10/miner-known.html

** curl -I http://192.168.56.10/benign-coinhive-name.html

** curl -I http://192.168.56.10/monero-webminer/

=== 3) Measurement procedure (repeatable) ===
Each tool is tested against each page with the same procedure:

Open a Private Window (or clear cache/site data between runs)

Open DevTools → Network, enable “Disable cache”

Load the page (Ctrl+Shift+R to force reload)

If the page has Start/Stop controls, click Start and observe:
** Blocked? (Y/N)
** Detection latency (approx. seconds or measured via timestamps)
** False positive? (Y/N) for benign and heavy-benign and benign-coinhive-name
** What was blocked (script URL, worker load, domain/WebSocket endpoint, host)

Capture evidence screenshots

=== 4) data collection ===
Pages:

== Results So Far (initial run) ==

Baseline benign pages (benign.html, heavy-benign.html) loaded normally for all tools tested (no false positives observed in initial pass).

Name-based control (benign-coinhive-name.html using coinhive.js) was not blocked in the initial pass for most tools, indicating that simple substring matching is not universal; however, signature-like names can still trigger blocking depending on the exact filename/list.

Synthetic miner (synthetic-miner.html using pow-worker.js) was not blocked by several tools in the initial pass, suggesting limited behavioral detection for purely CPU-based worker workloads.

Known-signature miner (miner-known.html using coinhive.min.js) was blocked by tools that rely on known miner indicators/lists; the block was visible as a blocked script request and/or extension UI warning.

Real mining sample (monero-webminer/) produced WebSocket connections to an external endpoint (101 Switching Protocols) when not blocked; some tools blocked the mining client script and prevented mining from starting, while others did not detect it in the initial pass.

[[Category:Documentation]]

(Article title)

2026-01-20T20:14:56Z

YRahal: YRahal moved page (Article title) to Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools: Title Change

#REDIRECT [[Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools]]

Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools

2026-01-20T20:14:56Z

YRahal: YRahal moved page (Article title) to Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools: Title Change

== Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools ==
This project evaluates how effective and practical browser-based cryptojacking tools are in a controlled VM lab environment. The lab uses a Web VM that hosts multiple test websites and a Victim VM that visits them using Firefox. The websites include benign pages and miner-like pages that generate sustained CPU load via a WebWorker and optionally send periodic network requests to a local /ping endpoint. The goal is to observe whether a tool blocks the miner-like pages, whether it incorrectly blocks benign pages, and how the tool behaves (block message, stopped execution, etc.).

== Setup ==

Host Machine: Windows with VirtualBox
Web VM (Ubuntu): nginx web server hosting the test pages
Victim VM (Ubuntu): Firefox browser used to access the pages
Network: Host-only network between the two VMs (example: 192.168.56.0/24)
Web VM IP: 192.168.56.10 (host-only interface)
Victim VM IP: 192.168.56.107 (host-only interface)
Test websites hosted by nginx (served from /var/www/html/)

#* benign.html (no mining behavior)
#* heavy-benign.html (CPU-heavy but legitimate)
#* synthetic-miner.html (miner-like CPU + periodic /ping)
#* miner-known.html (miner-like page that loads the worker as “coinhive.min.js”)

Test mining-like worker file(s)

#* pow-worker.js (synthetic PoW-style workload, CPU-only)
#* coinhive.min.js (copy/rename of the worker to test signature-based blocking)

Tested extension (so far)

#* MinerBlock (Firefox extension)

== Implementation ==

Prepare connectivity between VMs

#* On Web VM: confirm IP address (ip a) and note host-only address (192.168.56.10)
#* On Victim VM: confirm IP address (ip a) and ensure it can reach the web VM (ping 192.168.56.10)

Host test pages on Web VM using nginx

#* Copy/create website files in nginx document root:
#** /var/www/html/benign.html
#** /var/www/html/heavy-benign.html
#** /var/www/html/synthetic-miner.html
#** /var/www/html/miner-known.html
#* Confirm files are available:
#** curl -I http://192.168.56.10/benign.html

#** curl -I http://192.168.56.10/heavy-benign.html

#** curl -I http://192.168.56.10/synthetic-miner.html

#** curl -I http://192.168.56.10/miner-known.html

Create the “known-signature” miner worker variant

#* Ensure the worker exists in the web root:
#** /var/www/html/coinhive.min.js
#* This file is used to test whether a mining blocker reacts to known miner naming/signatures.

Baseline observation (no extension)

#* Open miner-like page in Firefox on Victim VM (example: synthetic-miner.html)
#* Click Start and observe:
#** sustained high CPU usage on the victim (system monitor)
#** repeated “SOLVED …” messages on the page console/log (proof the worker is running)
#** repeated “PING ok latency(ms): …” messages (proof periodic requests happen)

MinerBlock test (extension enabled)

#* Enable MinerBlock in Firefox on Victim VM
#* Open miner-known.html on Victim VM:
#** URL: http://192.168.56.10/miner-known.html

#* Click Start
#* Observation/result (current progress):
#** MinerBlock displayed “Blocked Miners: 1” and listed 192.168.56.10
#** The miner-like activity was stopped/blocked (confirmed by the extension UI and the page behavior)
#* Capture evidence:
#** Screenshot of MinerBlock popup showing the blocked miner and the host
#** Screenshot of the page showing Start/Stop state and the absence/interruption of the miner workload

== Results So Far ==

Benign pages

#* benign.html: created and served successfully (no detection test recorded yet)
#* heavy-benign.html: created and served successfully (used for false-positive testing later)

Miner-like pages

#* synthetic-miner.html: produces sustained CPU usage and “SOLVED” messages (miner-like workload confirmed)
#* miner-known.html: successfully triggered MinerBlock, which reported one blocked miner (192.168.56.10) and stopped the miner-like behavior

== Next Steps ==

Verify what exactly MinerBlock blocks

#* Check whether it blocks the worker script load (e.g., Worker fails to load) or blocks network requests (/ping) or both
#* Collect a short browser console log (F12 → Console) during the block event

Add “unknown vs known” comparison (recommended)

#* miner-unknown.html: uses pow-worker.js (custom name)
#* miner-known.html: uses coinhive.min.js (signature-bait name)
#* Test whether MinerBlock blocks both or only the known-signature variant

Introduce simple repeatable measurement (later)

#* For each run: record whether blocked/allowed, and capture screenshots
#* Optionally log /ping on the server for latency measurement

[[Category:Documentation]]

Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools

2026-01-20T20:10:02Z

YRahal: