@fanboynz/network-scanner 2.0.54 → 2.0.56

package/lib/browserexit.js

@@ -15,7 +15,7 @@ const CHROME_TEMP_PATHS = [
 ];
 
 const CHROME_TEMP_PATTERNS = [
-  '.com.google.Chrome.*',        // Google Chrome temp files
+  'com.google.Chrome.*',         // Google Chrome temp files (no leading dot)
   '.org.chromium.Chromium.*',
   'puppeteer-*'
 ];
@@ -39,6 +39,7 @@ async function cleanupChromeTempFiles(options = {}) {
 
     // Base cleanup commands for standard temp directories
     const cleanupCommands = [
+      'rm -rf /tmp/com.google.Chrome.* 2>/dev/null || true',
       'rm -rf /tmp/.com.google.Chrome.* 2>/dev/null || true',
       'rm -rf /tmp/.org.chromium.Chromium.* 2>/dev/null || true',
       'rm -rf /tmp/puppeteer-* 2>/dev/null || true',
@@ -48,6 +49,7 @@ async function cleanupChromeTempFiles(options = {}) {
 
     // Add snap-specific cleanup if requested
     if (includeSnapTemp || comprehensive) {
+      cleanupCommands.push('rm -rf /dev/shm/com.google.Chrome.* 2>/dev/null || true');
       cleanupCommands.push(
         'rm -rf /tmp/snap-private-tmp/snap.chromium/tmp/.org.chromium.Chromium.* 2>/dev/null || true',
         'rm -rf /tmp/snap-private-tmp/snap.chromium/tmp/puppeteer-* 2>/dev/null || true'

package/lib/cloudflare.js

@@ -1,5 +1,20 @@
 /**
  * Cloudflare bypass and challenge handling module - Optimized with smart detection and adaptive timeouts
+ * Version: 2.7.0 - Major fixes and performance overhaul
+ *   - Fix: Challenge solvers had empty if-blocks (JS/Turnstile/Legacy never executed in non-debug mode)
+ *   - Fix: a[href*="continue"] false positive removed (matched nearly every website)
+ *   - Perf: Domain-level detection cache (was per-URL, now per-hostname)
+ *   - Perf: Timeout outcome caching (domain times out once -> all subsequent URLs skip instantly)
+ *   - Perf: Short-circuit quick detection (title/URL -> fast selectors -> slow text, early return at each stage)
+ *   - Perf: Eliminated body.textContent in quick detection (was extracting entire DOM text tree)
+ *   - Perf: Capped body.textContent to 2KB in analyzeCloudflareChallenge
+ *   - Perf: No-indicator pages skip immediately regardless of config (was 10-15s wasted)
+ *   - Perf: Quick detection timeout 4s->2s, retries 2->1
+ *   - Perf: PAGE_EVALUATION timeout 12s->5s, detached frame delay 3s->1s
+ *   - Perf: Inner timeouts tightened to fit within outer adaptive timeouts
+ *   - Perf: CHALLENGE_SOLVING 30s->12s, TURNSTILE_COMPLETION 20s->10s, JS_CHALLENGE_BUFFER 26s->12s
+ *   - Perf: MAX_RETRIES 3->2, baseDelay 1000->800ms, maxDelay 8000->5000ms
+ *   - Perf: Parallel detection gated behind cloudflare config (was running on every URL)
  * Version: 2.6.3 - Fixes Cannot read properties of undefined (reading 'hasIndicators')
  * Version: 2.6.2 - Further detached Frame fixes 
  * Version: 2.6.1 - timeoutId is not defined & race condition fix
@@ -20,7 +35,7 @@ const { formatLogMessage } = require('./colorize');
 /**
  * Module version information
  */
-const CLOUDFLARE_MODULE_VERSION = '2.6.3';
+const CLOUDFLARE_MODULE_VERSION = '2.7.0';
 
 /**
  * Timeout constants for various operations (in milliseconds)
@@ -28,13 +43,13 @@ const CLOUDFLARE_MODULE_VERSION = '2.6.3';
  * All values tuned for maximum scanning speed while maintaining functionality
  */
 const TIMEOUTS = {
-  PAGE_EVALUATION: 12000,           // Standard page evaluation timeout
-  PAGE_EVALUATION_SAFE: 12000,     // Safe page evaluation with extra buffer
+  PAGE_EVALUATION: 5000,             // Standard page evaluation timeout (DOM queries are instant)
+  PAGE_EVALUATION_SAFE: 5000,       // Safe page evaluation with extra buffer
   PHISHING_CLICK: 3000,           // Timeout for clicking phishing continue button
   PHISHING_NAVIGATION: 8000,       // Wait for navigation after phishing bypass
-  JS_CHALLENGE_BUFFER: 26000,     // JS challenge with safety buffer
-  TURNSTILE_COMPLETION: 20000,    // Turnstile completion check
-  TURNSTILE_COMPLETION_BUFFER: 25000, // Turnstile completion with buffer
+  JS_CHALLENGE_BUFFER: 12000,     // JS challenge -- must fit within 15s adaptive outer timeout
+  TURNSTILE_COMPLETION: 10000,    // Turnstile completion check -- fits within adaptive timeout
+  TURNSTILE_COMPLETION_BUFFER: 12000, // Turnstile completion with buffer
   CLICK_TIMEOUT: 5000,            // Standard click operation timeout
   CLICK_TIMEOUT_BUFFER: 1000,     // Click timeout safety buffer
   NAVIGATION_TIMEOUT: 15000,      // Standard navigation timeout
@@ -45,21 +60,21 @@ const TIMEOUTS = {
   ADAPTIVE_TIMEOUT_AUTO_WITHOUT_INDICATORS: 10000, // Adaptive timeout for auto-detected without indicators
   // New timeouts for enhanced functionality
   RETRY_DELAY: 1000,              // Delay between retry attempts
-  MAX_RETRIES: 3,                 // Maximum retry attempts for operations
+  MAX_RETRIES: 2,                 // Maximum retry attempts (only 2 fit within 25s outer timeout)
   CHALLENGE_POLL_INTERVAL: 500,   // Interval for polling challenge completion
   CHALLENGE_MAX_POLLS: 20         // Maximum polling attempts
 };
 
 // Fast timeout constants - optimized for speed
 const FAST_TIMEOUTS = {
-  QUICK_DETECTION: 4000,           // Fast Cloudflare detection
+  QUICK_DETECTION: 2000,           // Fast Cloudflare detection (DOM check, instant on loaded pages)
   PHISHING_WAIT: 1000,            // Fast phishing check
   CHALLENGE_WAIT: 500,            // Fast challenge detection
   ELEMENT_INTERACTION_DELAY: 250, // Fast element interactions
   SELECTOR_WAIT: 3000,            // Fast selector waits
   TURNSTILE_OPERATION: 6000,      // Fast Turnstile operations
   JS_CHALLENGE: 10000,            // Fast JS challenge completion
-  CHALLENGE_SOLVING: 30000,       // Fast overall challenge solving
+  CHALLENGE_SOLVING: 12000,       // Overall challenge solving -- fits within 15s adaptive outer
   CHALLENGE_COMPLETION: 8000      // Fast completion check
 };
 
@@ -68,7 +83,7 @@ const FAST_TIMEOUTS = {
  * Returns {found, clicked, x, y} - coordinates allow fallback mouse.click
  */
 async function clickInShadowDOM(context, selectors, forceDebug = false, waitMs = 1500) {
-  // Try Puppeteer's pierce/ selector first � handles CLOSED shadow roots via CDP
+  // Try Puppeteer's pierce/ selector first -- handles CLOSED shadow roots via CDP
   for (const selector of selectors) {
     try {
       // Wait for element to appear (handles delayed rendering)
@@ -77,7 +92,7 @@ async function clickInShadowDOM(context, selectors, forceDebug = false, waitMs =
       if (element) {
         const box = await element.boundingBox();
         if (box && box.width > 0 && box.height > 0) {
-          if (forceDebug) console.log(formatLogMessage('cloudflare', `pierce/${selector} matched in ${Date.now() - start}ms � box: ${box.width}x${box.height} at (${box.x},${box.y})`));
+          if (forceDebug) console.log(formatLogMessage('cloudflare', `pierce/${selector} matched in ${Date.now() - start}ms -- box: ${box.width}x${box.height} at (${box.x},${box.y})`));
           await element.click();
           await element.dispose();
           return { found: true, clicked: true, selector, x: box.x + box.width / 2, y: box.y + box.height / 2 };
@@ -185,9 +200,9 @@ function detectChallengeLoop(url, previousUrls = []) {
  * Retry configuration with exponential backoff
  */
 const RETRY_CONFIG = {
-  maxAttempts: 3,
-  baseDelay: 1000,
-  maxDelay: 8000,
+  maxAttempts: 2,       // Only 2 attempts fit within 25s outer timeout
+  baseDelay: 800,       // Slightly faster retry delay
+  maxDelay: 5000,       // Lower max delay cap
   backoffMultiplier: 2,
   retryableErrors: [ERROR_TYPES.NETWORK, ERROR_TYPES.TIMEOUT, ERROR_TYPES.ELEMENT_NOT_FOUND, ERROR_TYPES.DETACHED_FRAME]
 };
@@ -209,7 +224,7 @@ class CloudflareDetectionCache {
   getCacheKey(url) {
     try {
       const urlObj = new URL(url);
-      return `${urlObj.hostname}${urlObj.pathname}`;
+      return urlObj.hostname; // Domain-level caching: all URLs from same host share one entry
     } catch {
       return url;
     }
@@ -441,8 +456,8 @@ async function safePageEvaluate(page, func, timeout = TIMEOUTS.PAGE_EVALUATION_S
         if (forceDebug) {
           console.warn(formatLogMessage('cloudflare', `Detached frame detected on attempt ${attempt}/${maxRetries} - using longer delay`));
         }
-        // For detached frames, wait longer
-        await new Promise(resolve => setTimeout(resolve, 3000)); // Longer delay
+        // For detached frames, brief delay before retry
+        await new Promise(resolve => setTimeout(resolve, 1000));
         
         // For detached frames, only retry once more
         if (attempt >= 2) {
@@ -541,44 +556,67 @@ async function quickCloudflareDetection(page, forceDebug = false) {
     // Perform actual detection with enhanced error handling
     const quickCheck = await safePageEvaluate(page, () => {
       const title = document.title || '';
-      const bodyText = document.body ? document.body.textContent.substring(0, 500) : '';
       const url = window.location.href;
       
-      // Enhanced indicators with 2025 patterns
-      const hasCloudflareIndicators = 
+      // FAST PATH: Check title + URL first (string ops, no DOM traversal)
+      const titleMatch = 
         title.includes('Just a moment') ||
         title.includes('Checking your browser') ||
         title.includes('Attention Required') ||
-        title.includes('Security check') || // New pattern
+        title.includes('Security check');
+      
+      const urlMatch =
+        url.includes('/cdn-cgi/challenge-platform/') ||
+        url.includes('cloudflare.com');
+      
+      if (titleMatch || urlMatch) {
+        return { hasIndicators: true, title, url, bodySnippet: '' };
+      }
+      
+      // MEDIUM PATH: Check a few fast selectors before expensive text extraction
+      const selectorMatch =
+        document.querySelector('[data-ray]') ||
+        document.querySelector('[data-cf-challenge]') ||
+        document.querySelector('.cf-challenge-running') ||
+        document.querySelector('.cf-turnstile') ||
+        document.querySelector('.cf-managed-challenge') ||
+        document.querySelector('[data-cf-managed]') ||
+        document.querySelector('script[src*="/cdn-cgi/challenge-platform/"]');
+      
+      if (selectorMatch) {
+        return { hasIndicators: true, title, url, bodySnippet: '' };
+      }
+      
+      // SLOW PATH: Extract limited body text only if fast checks failed
+      // Use body.innerText capped to first child nodes instead of full textContent
+      let bodyText = '';
+      if (document.body) {
+        const el = document.body.querySelector('.main-wrapper, .main-content, #challenge-body-text, .cf-challenge-container');
+        bodyText = el ? el.textContent.substring(0, 300) : (document.body.firstElementChild ? document.body.firstElementChild.textContent.substring(0, 300) : '');
+      }
+      
+      const textMatch =
         bodyText.includes('Cloudflare') ||
         bodyText.includes('cf-ray') ||
         bodyText.includes('Verify you are human') ||
         bodyText.includes('This website has been reported for potential phishing') ||
         bodyText.includes('Please wait while we verify') ||
-        bodyText.includes('Checking if the site connection is secure') || // New pattern
-        url.includes('/cdn-cgi/challenge-platform/') ||
-        url.includes('cloudflare.com') ||
-        document.querySelector('[data-ray]') ||
-        document.querySelector('[data-cf-challenge]') ||
-        document.querySelector('.cf-challenge-running') ||
+        bodyText.includes('Checking if the site connection is secure');
+      
+      // Remaining slower selectors
+      const slowSelectorMatch =
         document.querySelector('.cf-challenge-container') ||
-        document.querySelector('.cf-turnstile') ||
         document.querySelector('.ctp-checkbox-container') ||
         document.querySelector('iframe[src*="challenges.cloudflare.com"]') ||
-        document.querySelector('iframe[title*="Cloudflare security challenge"]') ||
-        document.querySelector('script[src*="/cdn-cgi/challenge-platform/"]') ||
-        document.querySelector('a[href*="continue"]') ||
-        // New selectors for 2025
-        document.querySelector('.cf-managed-challenge') ||
-        document.querySelector('[data-cf-managed]');
+        document.querySelector('iframe[title*="Cloudflare security challenge"]');
       
       return {
-        hasIndicators: hasCloudflareIndicators,
+        hasIndicators: !!(textMatch || slowSelectorMatch),
         title,
         url,
         bodySnippet: bodyText.substring(0, 200)
       };
-    }, FAST_TIMEOUTS.QUICK_DETECTION, { maxRetries: 2, forceDebug });
+    }, FAST_TIMEOUTS.QUICK_DETECTION, { maxRetries: 1, forceDebug });
     
     // Cache the result
     detectionCache.set(currentPageUrl, quickCheck);
@@ -607,7 +645,7 @@ async function quickCloudflareDetection(page, forceDebug = false) {
  */
 async function analyzeCloudflareChallenge(page) {
   try {
-    // CDP-level frame check � bypasses closed shadow roots
+    // CDP-level frame check -- bypasses closed shadow roots
     const frames = page.frames();
     const hasChallengeFrame = frames.some(f => {
       const url = f.url();
@@ -616,7 +654,8 @@ async function analyzeCloudflareChallenge(page) {
 
     const result = await safePageEvaluate(page, () => {
       const title = document.title || '';
-      const bodyText = document.body ? document.body.textContent : '';
+      // Cap text extraction -- on content-heavy pages body.textContent can be megabytes
+      const bodyText = document.body ? document.body.textContent.substring(0, 2000) : '';
       
       // Updated selectors for 2025 Cloudflare challenges
       const hasTurnstileIframe = document.querySelector('iframe[title*="Cloudflare security challenge"]') !== null ||
@@ -649,8 +688,7 @@ async function analyzeCloudflareChallenge(page) {
                             bodyText.includes('Please wait while we verify');
       
       const hasPhishingWarning = bodyText.includes('This website has been reported for potential phishing') ||
-                                title.includes('Attention Required') ||
-                                document.querySelector('a[href*="continue"]') !== null;
+                                title.includes('Attention Required');
       
       const hasTurnstileResponse = document.querySelector('input[name="cf-turnstile-response"]') !== null;
       
@@ -687,7 +725,7 @@ async function analyzeCloudflareChallenge(page) {
       };
     }, TIMEOUTS.PAGE_EVALUATION);
 
-    // Merge CDP frame detection � catches iframes behind closed shadow roots
+    // Merge CDP frame detection -- catches iframes behind closed shadow roots
     if (hasChallengeFrame && !result.hasTurnstileIframe) {
       result.hasTurnstileIframe = true;
       result.isTurnstile = true;
@@ -1088,20 +1126,10 @@ async function attemptChallengeSolve(page, currentUrl, challengeInfo, forceDebug
       if (jsResult.success) {
         // Wait for redirect after challenge completion
         try {
-          const startUrl = await page.url();
-          await page.waitForFunction(
-            (origUrl) => {
-              const bodyText = document.body?.textContent || '';
-              return document.title !== 'Just a moment...' ||
-                     window.location.href !== origUrl ||
-                     bodyText.includes('Verification successful');
-            },
-            { timeout: 10000 },
-            startUrl
-          );
-          if (forceDebug) console.log(formatLogMessage('cloudflare', `Challenge page cleared for ${currentUrl}`));
-        } catch (_) {
-          if (forceDebug) console.log(formatLogMessage('cloudflare', `Challenge page not cleared after 10s � continuing`));
+          await page.waitForNavigation({ waitUntil: 'domcontentloaded', timeout: 10000 });
+          if (forceDebug) console.log(formatLogMessage('cloudflare', `Post-challenge redirect completed for ${currentUrl}`));
+        } catch (navErr) {
+          if (forceDebug) console.log(formatLogMessage('cloudflare', `Post-challenge redirect timeout (may already be on target page): ${navErr.message}`));
         }
         result.success = true;
         result.method = 'js_challenge_wait';
@@ -1183,7 +1211,7 @@ async function handleEmbeddedIframeChallenge(page, forceDebug = false) {
   try {
     if (forceDebug) console.log(formatLogMessage('cloudflare', `Checking for embedded iframe challenges`));
 
-    // Use CDP-level frame detection � bypasses closed shadow roots
+    // Use CDP-level frame detection -- bypasses closed shadow roots
     const frames = page.frames();
     if (forceDebug) {
       console.log(formatLogMessage('cloudflare', `Available frames (${frames.length}):`));
@@ -1624,10 +1652,11 @@ async function handleCloudflareProtection(page, currentUrl, siteConfig, forceDeb
 
   // Early return structure when no Cloudflare indicators found
   // Sets attempted: false, success: true for both protection types
- 
-  // Only proceed if we have indicators OR explicit config enables Cloudflare handling
-  if (!quickDetection.hasIndicators && !cfPhishEnabled && !cfBypassEnabled) {
-    if (forceDebug) console.log(formatLogMessage('cloudflare', `No Cloudflare indicators found and no explicit config, skipping protection handling for ${currentUrl}`));
+  // Skip immediately if no Cloudflare indicators detected
+  // Trust the detection -- explicit config only matters when indicators ARE found
+  // This avoids a 10s adaptive timeout on non-Cloudflare sites
+  if (!quickDetection.hasIndicators) {
+    if (forceDebug) console.log(formatLogMessage('cloudflare', `No Cloudflare indicators found, skipping protection handling for ${currentUrl}`));
     if (forceDebug) console.log(formatLogMessage('cloudflare', `Quick detection details: title="${quickDetection.title}", bodySnippet="${quickDetection.bodySnippet}"`));
     return {
       phishingWarning: { attempted: false, success: true },
@@ -1663,10 +1692,24 @@ async function handleCloudflareProtection(page, currentUrl, siteConfig, forceDeb
       console.log(formatLogMessage('cloudflare', `Using adaptive timeout of ${adaptiveTimeout}ms for ${currentUrl} (indicators: ${quickDetection.hasIndicators}, explicit config: ${!!(siteConfig.cloudflare_phish || siteConfig.cloudflare_bypass)})`));
     }
     
-    return await Promise.race([
-      performCloudflareHandling(page, currentUrl, siteConfig, cfDebug),
+    // Check if this domain already timed out -- skip immediately
+    try {
+      const outcomeCacheKey = 'outcome:' + new URL(currentUrl).hostname;
+      const cachedOutcome = detectionCache.cache.get(outcomeCacheKey);
+      if (cachedOutcome && cachedOutcome.data && cachedOutcome.data.timedOut && Date.now() - cachedOutcome.timestamp < detectionCache.ttl) {
+        if (forceDebug) console.log(formatLogMessage('cloudflare', `Skipping ${currentUrl} -- domain already timed out on a previous URL`));
+        return cachedOutcome.data;
+      }
+    } catch (e) { /* malformed URL, proceed normally */ }
+    
+    let adaptiveTimeoutId = null;
+    const handlingResult = await Promise.race([
+      performCloudflareHandling(page, currentUrl, siteConfig, cfDebug).then(r => {
+        if (adaptiveTimeoutId) clearTimeout(adaptiveTimeoutId);
+        return r;
+      }),
       new Promise((resolve) => {
-        setTimeout(() => {
+        adaptiveTimeoutId = setTimeout(() => {
         console.warn(formatLogMessage('cloudflare', `Adaptive timeout (${adaptiveTimeout}ms) for ${currentUrl} - continuing with scan`));
           resolve({
             phishingWarning: { attempted: false, success: true },
@@ -1678,6 +1721,16 @@ async function handleCloudflareProtection(page, currentUrl, siteConfig, forceDeb
         }, adaptiveTimeout);
       })
     ]);
+    
+    // Cache timeout results at domain level so subsequent URLs skip immediately
+    if (handlingResult.timedOut) {
+      try {
+        const setOutcomeKey = 'outcome:' + new URL(currentUrl).hostname;
+        detectionCache.cache.set(setOutcomeKey, { data: handlingResult, timestamp: Date.now() });
+      } catch (e) { /* malformed URL, skip caching */ }
+    }
+    
+    return handlingResult;
   } catch (error) {
     result.overallSuccess = false;
     result.errors.push(`Cloudflare handling failed: ${error.message}`);
@@ -1809,8 +1862,7 @@ async function parallelChallengeDetection(page, forceDebug = false) {
         { type: 'turnstile', detected: document.querySelector('.cf-turnstile') !== null ||
             document.querySelector('iframe[src*="challenges.cloudflare.com"]') !== null ||
             document.querySelector('.ctp-checkbox-container') !== null },
-        { type: 'phishing', detected: bodyText.includes('This website has been reported for potential phishing') ||
-            document.querySelector('a[href*="continue"]') !== null },
+        { type: 'phishing', detected: bodyText.includes('This website has been reported for potential phishing') },
         { type: 'managed', detected: document.querySelector('.cf-managed-challenge') !== null ||
             document.querySelector('[data-cf-managed]') !== null }
       ];

package/lib/fingerprint.js

@@ -24,28 +24,6 @@ function seededRandom(seed) {
 const _fingerprintCache = new Map();
 
 // Type-specific property spoofing functions for monomorphic optimization
-function spoofNavigatorProperties(navigator, properties, options = {}) {
-  if (!navigator || typeof navigator !== 'object') return false;
-  
-  for (const [prop, descriptor] of Object.entries(properties)) {
-    if (!safeDefineProperty(navigator, prop, descriptor, options)) {
-      if (options.debug) console.log(`[fingerprint] Failed to spoof navigator.${prop}`);
-    }
-  }
-  return true;
-}
-
-function spoofScreenProperties(screen, properties, options = {}) {
-  if (!screen || typeof screen !== 'object') return false;
-  
-  for (const [prop, descriptor] of Object.entries(properties)) {
-    if (!safeDefineProperty(screen, prop, descriptor, options)) {
-      if (options.debug) console.log(`[fingerprint] Failed to spoof screen.${prop}`);
-    }
-  }
-  return true;
-}
-
 // Built-in properties that should not be modified
 const BUILT_IN_PROPERTIES = new Set([
   'href', 'origin', 'protocol', 'host', 'hostname', 'port', 'pathname', 'search', 'hash',
@@ -379,6 +357,27 @@ async function applyUserAgentSpoofing(page, siteConfig, forceDebug, currentUrl)
             return false;
           };
         })();
+
+        // Function.prototype.toString protection — make spoofed functions appear native
+        // Must be installed BEFORE any property overrides so all spoofs are protected
+        const nativeFunctionStore = new WeakMap();
+        const originalToString = Function.prototype.toString;
+        
+        function maskAsNative(fn, nativeName) {
+          if (typeof fn === 'function') {
+            nativeFunctionStore.set(fn, nativeName || fn.name || '');
+          }
+          return fn;
+        }
+        
+        Function.prototype.toString = function() {
+          if (nativeFunctionStore.has(this)) {
+            return `function ${nativeFunctionStore.get(this)}() { [native code] }`;
+          }
+          return originalToString.call(this);
+        };
+        // Protect the toString override itself
+        nativeFunctionStore.set(Function.prototype.toString, 'toString');
         
         // Create safe property definition helper
         function safeDefinePropertyLocal(target, property, descriptor) {
@@ -439,10 +438,14 @@ async function applyUserAgentSpoofing(page, siteConfig, forceDebug, currentUrl)
         // Remove webdriver properties
         //
         safeExecute(() => {
-          try {
-            delete navigator.webdriver;
-          } catch (e) {}
-          safeDefinePropertyLocal(navigator, 'webdriver', { get: () => false });
+          // In real Chrome, webdriver lives on Navigator.prototype, not the instance.
+          // Override it there so Object.getOwnPropertyDescriptor(navigator, 'webdriver') returns undefined.
+          try { delete navigator.webdriver; } catch (e) {}
+          Object.defineProperty(Navigator.prototype, 'webdriver', {
+            get: () => false,
+            configurable: true,
+            enumerable: true
+          });
         }, 'webdriver removal');
 
         // Remove automation properties
@@ -861,6 +864,8 @@ async function applyUserAgentSpoofing(page, siteConfig, forceDebug, currentUrl)
                 if (typeof originalStack === 'string') {
                   return originalStack
                     .replace(/.*puppeteer.*\n?/gi, '')
+                    .replace(/.*__puppeteer_evaluation_script__.*\n?/gi, '')
+                    .replace(/.*evaluateOnNewDocument.*\n?/gi, '')
                     .replace(/.*chrome-devtools.*\n?/gi, '')
                     .replace(/.*webdriver.*\n?/gi, '')
                     .replace(/.*automation.*\n?/gi, '')
@@ -1635,6 +1640,55 @@ async function applyUserAgentSpoofing(page, siteConfig, forceDebug, currentUrl)
           });
         }, 'location URL masking');
 
+        // Bulk-mask all spoofed prototype methods so toString() returns "[native code]"
+        // Must run AFTER all overrides are applied
+        safeExecute(() => {
+          const protoMasks = [
+            [WebGLRenderingContext.prototype, ['getParameter', 'getExtension', 'getSupportedExtensions']],
+            [HTMLCanvasElement.prototype, ['getContext', 'toDataURL', 'toBlob']],
+            [CanvasRenderingContext2D.prototype, ['getImageData', 'fillText', 'strokeText', 'measureText']],
+            [EventTarget.prototype, ['addEventListener', 'removeEventListener']],
+            [Date.prototype, ['getTimezoneOffset']],
+          ];
+          if (typeof WebGL2RenderingContext !== 'undefined') {
+            protoMasks.push([WebGL2RenderingContext.prototype, ['getParameter', 'getExtension']]);
+          }
+          protoMasks.forEach(([proto, methods]) => {
+            methods.forEach(name => {
+              if (typeof proto[name] === 'function') maskAsNative(proto[name], name);
+            });
+          });
+
+          // Mask navigator/window method overrides
+          if (typeof navigator.permissions?.query === 'function') maskAsNative(navigator.permissions.query, 'query');
+          if (typeof navigator.getBattery === 'function') maskAsNative(navigator.getBattery, 'getBattery');
+          if (typeof speechSynthesis?.getVoices === 'function') maskAsNative(speechSynthesis.getVoices, 'getVoices');
+          if (typeof performance.now === 'function') maskAsNative(performance.now, 'now');
+          if (typeof Notification?.requestPermission === 'function') maskAsNative(Notification.requestPermission, 'requestPermission');
+          if (typeof window.RTCPeerConnection === 'function') maskAsNative(window.RTCPeerConnection, 'RTCPeerConnection');
+          if (typeof window.Image === 'function') maskAsNative(window.Image, 'Image');
+          if (typeof window.fetch === 'function') maskAsNative(window.fetch, 'fetch');
+          if (typeof window.PointerEvent === 'function') maskAsNative(window.PointerEvent, 'PointerEvent');
+
+          // Mask property getters on navigator
+          const navProps = ['userAgentData', 'connection', 'pdfViewerEnabled', 'webdriver',
+                            'hardwareConcurrency', 'deviceMemory', 'platform', 'maxTouchPoints'];
+          navProps.forEach(prop => {
+            // Check both instance and prototype (webdriver lives on prototype)
+            const desc = Object.getOwnPropertyDescriptor(navigator, prop)
+                      || Object.getOwnPropertyDescriptor(Navigator.prototype, prop);
+            if (desc?.get) maskAsNative(desc.get, 'get ' + prop);
+          });
+
+          // Mask window property getters
+          ['screenX', 'screenY', 'outerWidth', 'outerHeight'].forEach(prop => {
+            const desc = Object.getOwnPropertyDescriptor(window, prop);
+            if (desc?.get) maskAsNative(desc.get, 'get ' + prop);
+          });
+
+          if (debugEnabled) console.log('[fingerprint] toString protection applied to all spoofed functions');
+        }, 'Function.prototype.toString bulk masking');
+
       }, ua, forceDebug, selectedGpu);
     } catch (stealthErr) {
       if (stealthErr.message.includes('Session closed') || 
@@ -2030,9 +2084,6 @@ async function applyAllFingerprintSpoofing(page, siteConfig, forceDebug, current
 }
 
 // Legacy compatibility function - maintained for backwards compatibility
-function safeExecuteSpoofing(spoofFunction, description, forceDebug = false) {
-  return safeSpoofingExecution(spoofFunction, description, { debug: forceDebug });
-}
 
 
 module.exports = {
@@ -2044,7 +2095,6 @@ module.exports = {
   applyAllFingerprintSpoofing,
   simulateHumanBehavior,
   safeDefineProperty,
-  safeExecuteSpoofing, // Legacy compatibility
   safeSpoofingExecution,
   DEFAULT_PLATFORM,
   DEFAULT_TIMEZONE

package/lib/interaction.js

@@ -123,6 +123,20 @@ const ELEMENT_INTERACTION = {
   MISTAKE_RATE: 0.02         // Probability of typing mistakes (0.02 = 2% chance)
 };
 
+// === CONTENT CLICK CONSTANTS ===
+// For triggering document-level onclick handlers (e.g., Monetag onclick_static)
+// These clicks target the page content area, not specific UI elements
+// NOTE: No preDelay needed — mouse movements + scrolling already provide ~1s
+// of activity before clicks fire, which is enough for async ad script registration
+const CONTENT_CLICK = {
+  CLICK_COUNT: 2,            // Two attempts (primary + backup if first suppressed)
+  INTER_CLICK_MIN: 300,      // Minimum ms between clicks (above Monetag 250ms cooldown)
+  INTER_CLICK_MAX: 500,      // Maximum ms between clicks
+  PRE_CLICK_DELAY: 300,      // Small buffer for late-loading async ad scripts
+  VIEWPORT_INSET: 0.2,       // Avoid outer 20% of viewport (menus, overlays)
+  MOUSE_APPROACH_STEPS: 3    // Minimal steps — just enough for non-instant movement
+};
+
 // === INTENSITY SETTINGS ===
 // Pre-configured intensity levels - modify these to change overall behavior
 const INTENSITY_SETTINGS = {
@@ -606,6 +620,97 @@ async function interactWithElements(page, options = {}) {
   }
 }
 
+/**
+ * Clicks random spots in the page content area to trigger document-level
+ * onclick handlers (Monetag onclick_static, similar popunder SDKs).
+ *
+ * WHY THIS EXISTS:
+ * Ad onclick SDKs attach a single listener on `document` (capture phase)
+ * that fires on ANY click with `isTrusted: true`. They don't care which
+ * element was clicked — just that a real input event reached the document.
+ * `interactWithElements()` hunts for <button>/<a> which may not exist or
+ * may be excluded by the SDK's own filter. This function simply clicks
+ * the content area of the page where the SDK will always accept the event.
+ *
+ * TIMING:
+ * - 300ms preDelay: small buffer after mouse/scroll activity (~1.2s) for
+ *   any late-loading async ad scripts to finish registering listeners.
+ * - Spaces clicks 300-500ms apart (above Monetag's 250ms cooldown).
+ * - Total time: ~1.1s for 2 clicks (preDelay + move + pause + click + gap).
+ *
+ * TARGETING:
+ * - Clicks within the inner 60% of the viewport to avoid sticky headers,
+ *   footers, sidebars, cookie banners, and overlay close buttons.
+ * - Each click gets a fresh random position with natural mouse approach.
+ *
+ * @param {import('puppeteer').Page} page
+ * @param {object} [options]
+ * @param {number} [options.clicks]         Number of click attempts
+ * @param {number} [options.preDelay]       Ms to wait before first click
+ * @param {number} [options.interClickMin]  Min ms between clicks
+ * @param {number} [options.interClickMax]  Max ms between clicks
+ * @param {boolean} [options.forceDebug]    Log click coordinates
+ */
+async function performContentClicks(page, options = {}) {
+  const {
+    clicks = CONTENT_CLICK.CLICK_COUNT,
+    preDelay = CONTENT_CLICK.PRE_CLICK_DELAY,
+    interClickMin = CONTENT_CLICK.INTER_CLICK_MIN,
+    interClickMax = CONTENT_CLICK.INTER_CLICK_MAX,
+    forceDebug = false
+  } = options;
+
+  try {
+    if (page.isClosed()) return;
+
+    const viewport = await getCachedViewport(page);
+    const inset = CONTENT_CLICK.VIEWPORT_INSET;
+    const minX = Math.floor(viewport.width * inset);
+    const maxX = Math.floor(viewport.width * (1 - inset));
+    const minY = Math.floor(viewport.height * inset);
+    const maxY = Math.floor(viewport.height * (1 - inset));
+
+    // Wait for ad scripts to register their listeners
+    await fastTimeout(preDelay);
+
+    let lastX = minX + Math.floor(Math.random() * (maxX - minX));
+    let lastY = minY + Math.floor(Math.random() * (maxY - minY));
+
+    for (let i = 0; i < clicks; i++) {
+      if (page.isClosed()) break;
+
+      // Random position in content zone
+      const targetX = minX + Math.floor(Math.random() * (maxX - minX));
+      const targetY = minY + Math.floor(Math.random() * (maxY - minY));
+
+      // Natural mouse approach (few steps, no need for elaborate curves)
+      await humanLikeMouseMove(page, lastX, lastY, targetX, targetY, {
+        steps: CONTENT_CLICK.MOUSE_APPROACH_STEPS,
+        curve: 0.03 + Math.random() * 0.04,
+        jitter: 1
+      });
+
+      // Brief human-like pause, then click
+      await fastTimeout(TIMING.CLICK_PAUSE_MIN + Math.random() * (TIMING.CLICK_PAUSE_MAX - TIMING.CLICK_PAUSE_MIN));
+      await page.mouse.click(targetX, targetY);
+
+      if (forceDebug) {
+        console.log(`[interaction] Content click ${i + 1}/${clicks} at (${targetX}, ${targetY})`);
+      }
+
+      lastX = targetX;
+      lastY = targetY;
+
+      // Inter-click gap (skip after last click)
+      if (i < clicks - 1) {
+        await fastTimeout(interClickMin + Math.random() * (interClickMax - interClickMin));
+      }
+    }
+  } catch (err) {
+    // Content clicks are supplementary — never break the scan
+  }
+}
+
 /**
  * Simulates realistic typing behavior with human characteristics
  * 
@@ -876,12 +981,22 @@ async function performPageInteraction(page, currentUrl, options = {}, forceDebug
       }
     }
 
-    // Element interaction
+    // Click interaction — two strategies for maximum ad script coverage
+    // 1. Content area clicks: triggers document-level onclick handlers
+    //    (Monetag, similar popunder SDKs that listen on document)
+    // 2. Element clicks: interacts with specific UI elements
+    //    (ad scripts that attach to specific clickable elements)
     if (includeElementClicks) {
-      await interactWithElements(page, {
-        maxAttempts: 2,
-        avoidDestructive: true
-      });
+      if (checkTimeout()) return; // Emergency timeout check
+      // Primary: content area clicks for document-level onclick handlers
+      await performContentClicks(page, { forceDebug });
+      // Secondary: targeted element clicks (fast, 1 attempt only)
+      if (!checkTimeout()) {
+        await interactWithElements(page, {
+          maxAttempts: 1,
+          avoidDestructive: true
+        });
+      }
     }
 
     // Periodic memory cleanup during interaction
@@ -1105,6 +1220,7 @@ module.exports = {
   humanLikeMouseMove,
   simulateScrolling,
   interactWithElements,
+  performContentClicks,
   simulateTyping,
   generateRandomCoordinates
 };

package/nwss.js

@@ -20,7 +20,8 @@ const {
   handleCloudflareProtection,
   getCacheStats,
   clearDetectionCache,
-  parallelChallengeDetection
+  parallelChallengeDetection,
+  cleanup: cleanupCloudflareCache
 } = require('./lib/cloudflare');
 // FP Bypass
 const { handleFlowProxyProtection, getFlowProxyTimeouts } = require('./lib/flowproxy');
@@ -39,7 +40,7 @@ const { processResults } = require('./lib/post-processing');
 // Colorize various text when used
 const { colorize, colors, messageColors, tags, formatLogMessage } = require('./lib/colorize');
 // Enhanced mouse interaction and page simulation
-const { performPageInteraction, createInteractionConfig } = require('./lib/interaction');
+const { performPageInteraction, createInteractionConfig, performContentClicks, humanLikeMouseMove } = require('./lib/interaction');
 // Domain detection cache for performance optimization
 const { createGlobalHelpers, getTotalDomainsSkipped, getDetectedDomainsCount } = require('./lib/domain-cache');
 const { createSmartCache } = require('./lib/smart-cache'); // Smart cache system
@@ -84,8 +85,8 @@ const TIMEOUTS = Object.freeze({
 });
 
 const CACHE_LIMITS = Object.freeze({
-  DISK_CACHE_SIZE: 52428800, // 50MB
-  MEDIA_CACHE_SIZE: 52428800, // 50MB
+  DISK_CACHE_SIZE: 1, // Effectively disabled — forcereload clears cache between loads
+  MEDIA_CACHE_SIZE: 1, // Effectively disabled — no media caching needed for scanning
   DEFAULT_CACHE_PATH: '.cache',
   DEFAULT_MAX_SIZE: 5000
 });
@@ -1020,11 +1021,28 @@ function flushLogBuffers() {
   for (const [filePath, entries] of _logBuffers) {
     if (entries.length > 0) {
       try {
-        fs.appendFileSync(filePath, entries.join(''));
+        const data = entries.join('');
+        entries.length = 0; // Clear buffer immediately
+        fs.writeFile(filePath, data, { flag: 'a' }, (err) => {
+          if (err) {
+            console.warn(formatLogMessage('warn', `Failed to flush log buffer to ${filePath}: ${err.message}`));
+          }
+        });
       } catch (err) {
         console.warn(formatLogMessage('warn', `Failed to flush log buffer to ${filePath}: ${err.message}`));
       }
-      entries.length = 0; // Clear buffer
+    }
+  }
+}
+
+// Synchronous flush for exit handlers — guarantees data is written before process exits
+function flushLogBuffersSync() {
+  for (const [filePath, entries] of _logBuffers) {
+    if (entries.length > 0) {
+      try {
+        fs.appendFileSync(filePath, entries.join(''));
+      } catch (err) { /* best effort on exit */ }
+      entries.length = 0;
     }
   }
 }
@@ -1426,12 +1444,19 @@ function setupFrameHandling(page, forceDebug) {
         '--use-mock-keychain',
         '--disable-client-side-phishing-detection',
         '--enable-features=NetworkService',
-        // Disk space controls - 50MB cache limits
-        `--disk-cache-size=${CACHE_LIMITS.DISK_CACHE_SIZE}`, // 50MB disk cache
-        `--media-cache-size=${CACHE_LIMITS.MEDIA_CACHE_SIZE}`, // 50MB media cache
+        // Disk space controls - minimal cache for scanning workloads
+        `--disk-cache-size=${CACHE_LIMITS.DISK_CACHE_SIZE}`,
+        `--media-cache-size=${CACHE_LIMITS.MEDIA_CACHE_SIZE}`,
         '--disable-application-cache',
         '--disable-offline-load-stale-cache',
         '--disable-background-downloads',
+        // DISK I/O REDUCTION: Eliminate unnecessary Chrome disk writes
+        '--disable-breakpad',          // No crash dump files
+        '--disable-component-update',  // No component update downloads
+        '--disable-logging',           // No Chrome internal log files
+        '--log-level=3',               // Fatal errors only (suppresses verbose disk logging)
+        '--no-service-autorun',        // No background service disk activity
+        '--disable-domain-reliability', // No reliability monitor disk writes
         // PERFORMANCE: Enhanced Puppeteer 23.x optimizations
         '--disable-features=AudioServiceOutOfProcess,VizDisplayCompositor',
         '--disable-features=TranslateUI,BlinkGenPropertyTrees,Translate',
@@ -1447,7 +1472,6 @@ function setupFrameHandling(page, forceDebug) {
         '--disable-features=SafeBrowsing',
         '--disable-dev-shm-usage',
         '--disable-sync',
-        '--disable-gpu',  // WebGL null-context handled by fingerprint.js Proxy mock
         '--mute-audio',
         '--disable-translate',
         '--window-size=1920,1080',
@@ -1467,6 +1491,12 @@ function setupFrameHandling(page, forceDebug) {
         '--disable-background-timer-throttling',
         '--disable-features=site-per-process', // Better for single-site scanning
         '--no-zygote', // Better process isolation
+        // PERFORMANCE: Process and memory reduction for high concurrency
+        '--renderer-process-limit=10',  // Cap renderer processes (default: unlimited)
+        '--disable-accelerated-2d-canvas', // Software canvas only (we spoof it anyway)
+        '--disable-hang-monitor',      // Remove per-renderer hang check overhead
+        '--disable-features=PaintHolding', // Don't hold frames in renderer memory
+        '--js-flags=--max-old-space-size=512', // Cap V8 heap per renderer to 512MB
         ...extraArgs,
         ],
         // Optimized timeouts for Puppeteer 23.x performance
@@ -1518,7 +1548,7 @@ function setupFrameHandling(page, forceDebug) {
   // Set up cleanup on process termination
   process.on('SIGINT', async () => {
     if (forceDebug) console.log(formatLogMessage('debug', 'SIGINT received, performing cleanup...'));
-    flushLogBuffers();
+    flushLogBuffersSync();
     if (_logFlushTimer) clearInterval(_logFlushTimer);
     await performEmergencyCleanup();
     process.exit(0);
@@ -1526,7 +1556,7 @@ function setupFrameHandling(page, forceDebug) {
 
   process.on('SIGTERM', async () => {
     if (forceDebug) console.log(formatLogMessage('debug', 'SIGTERM received, performing cleanup...'));
-    flushLogBuffers();
+    flushLogBuffersSync();
     if (_logFlushTimer) clearInterval(_logFlushTimer);
     await performEmergencyCleanup();
     process.exit(0);
@@ -1557,6 +1587,7 @@ function setupFrameHandling(page, forceDebug) {
     }
     wgDisconnectAll(forceDebug);
     ovpnDisconnectAll(forceDebug);
+    cleanupCloudflareCache();
   }
  
   let siteCounter = 0;
@@ -3220,7 +3251,9 @@ function setupFrameHandling(page, forceDebug) {
         siteCounter++;
 
         // Enhanced Cloudflare handling with parallel detection
-        if (siteConfig.cloudflare_parallel_detection !== false) { // Enable by default
+        // Only run parallel detection if cloudflare handling is explicitly configured
+        const hasCloudflareConfig = siteConfig.cloudflare_bypass || siteConfig.cloudflare_phish;
+        if (hasCloudflareConfig && siteConfig.cloudflare_parallel_detection !== false) {
           try {
             const parallelResult = await parallelChallengeDetection(page, forceDebug);
             if (parallelResult.hasAnyChallenge && forceDebug) {
@@ -3660,6 +3693,32 @@ function setupFrameHandling(page, forceDebug) {
           }
         }
 
+      // Post-reload interaction: trigger onclick ad scripts (Monetag etc.)
+      // Each reload gives a fresh session with a new random ad domain —
+      // without clicks the SDK never fires and we miss those domains.
+      if (interactEnabled && !page.isClosed()) {
+        try {
+          // Brief wait for ad scripts to re-register after reload
+          await fastTimeout(800);
+          // Quick mouse moves to build movement score (Monetag tracks this)
+          const vp = page.viewport() || { width: 1920, height: 1080 };
+          const startX = 200 + Math.floor(Math.random() * (vp.width - 400));
+          const startY = 200 + Math.floor(Math.random() * (vp.height - 400));
+          await page.mouse.move(startX, startY);
+          for (let m = 0; m < 2; m++) {
+            const endX = 200 + Math.floor(Math.random() * (vp.width - 400));
+            const endY = 200 + Math.floor(Math.random() * (vp.height - 400));
+            await humanLikeMouseMove(page, startX, startY, endX, endY, { steps: 3, curve: 0.04, jitter: 1 });
+          }
+          // Content clicks to trigger document-level onclick handlers
+          await performContentClicks(page, { clicks: 2, preDelay: 200, forceDebug });
+          if (forceDebug) console.log(formatLogMessage('debug', `Post-reload interaction completed for reload #${i}`));
+        } catch (postReloadInteractErr) {
+          // Non-critical — continue with remaining reloads
+          if (forceDebug) console.log(formatLogMessage('debug', `Post-reload interaction failed: ${postReloadInteractErr.message}`));
+        }
+      }
+
       // Only add delay if we're continuing with more reloads
       if (i < totalReloads) {
     // Reduce delay for problematic sites
@@ -4404,7 +4463,7 @@ function setupFrameHandling(page, forceDebug) {
   }
   
   // Flush any remaining buffered log entries before compression/exit
-  flushLogBuffers();
+  flushLogBuffersSync();
   if (_logFlushTimer) {
     clearInterval(_logFlushTimer);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fanboynz/network-scanner",
-  "version": "2.0.54",
+  "version": "2.0.56",
   "description": "A Puppeteer-based network scanner for analyzing web traffic, generating adblock filter rules, and identifying third-party requests. Features include fingerprint spoofing, Cloudflare bypass, content analysis with curl/grep, and multiple output formats.",
   "main": "nwss.js",
   "scripts": {