StealthDev: Side-Channel-Resistant Forensic Framework for Investigating Websites with Anti-Debugging

The analysis of JavaScript within websites is a foundational step in web security analysis. One of the most powerful tools available for such an analysis is the browser's integrated developer tools (DevTools), which provide deep visibility into the client-side code execution. However, sophisticated malicious websites often employ anti-debugging techniques to detect the presence of such tools and alter their behavior to appear benign. Prior research into such polymorphic sites has focused mainly on isolated client-side detection vectors, those that operate independently within the browser without requiring any coordination from the server. In this work, we argue that collusive vectors, which involve explicit communication between the client and an attacker-controlled server, are common, highly effective, and stealthy. These collusive client-attacker techniques evade detection by minimizing observable client-side artifacts, making them particularly challenging to analyze. Furthermore, despite the growing prevalence of such tactics, the security community still lacks a comprehensive framework to counter these anti-debugging tactics effectively.In this paper, we examine the prevalence of isolated and collusive anti-debugging vectors and then develop a solution that enables stealthy analysis of websites. First, we introduce a novel class of anti-debugging techniques in which adversaries exploit debugger-related resource requests, such as those for source maps or debugging symbols, initiated by the browser to detect DevTools. This mechanism allows attackers to detect the presence of active debuggers with a minimal client-side footprint. Through a large-scale analysis of the top 100,000 websites and their subpages, we find that approximately 1 in 17 websites employing severe anti-debugging measures leverage such collusive vectors to identify and obstruct DevTools-based analysis. Second, to defend against these threats, we present StealthDev, a policy-driven debugging framework built on a modified Chromium browser. StealthDev is specifically designed to remain stealthy and resilient against isolated and collusive anti-debugging techniques, including those relying on timing side channels. Our evaluation shows that StealthDev successfully bypasses anti-debugging defenses on over 97% of the most evasive websites, while incurring a modest performance overhead of just 5% on average page load times.