Browser Fingerprinting 👫 Anti-bot Detection

Here I study various aspects of existing evasion techniques to get around anti-bot systems. Looking for help with bypassing one?

PS. A ⭐ on this repo will be appreciated!

Random, maybe useful

• Cap FPS for Chromium with software rendering --use-gl=swiftshader - Limit CPU usage from SwiftShader by redraw freq. of Chromium in AVD
• Unlike some public comments on that matter chrome devtools protocol actually works on AVD-s with puppeteer

puppeteer-extra-plugin-stealth 😈

✔️ Win / ❌ Fail / 👔 Tie :

• 👔 p0f - detect host OS from TCP struct - Not possible to fix via Puppeteer APIs. Used in Akamai Bot Manager to match against JS and browser headers (Client Hints and User-Agent). There is a detailed explaination of the issue. The most reliable evasion seems to be not spoofing host OS at all, or using OSfooler-ng.
• 👔 Browser dimensions - Although stealth plugin provides window.outerdimensions evasion, it won't work without correct config on non-default OS in headless mode; almost always fails when viewport size >= screen resolution (low screen resolution display on the host).
• ❌ core-estimator - This can detect mismatch between navigator.hardwareConcurrency and SW/WW execution profile. Not possible to limit/bump the ServiceWorker/WebWorker thread limit via existng Puppeteer APIs.
• ❌ WebGL extensions profiling - desc. tbd
• ❌ RTCPeerConnection when behind a proxy - Applies to both SOCKS and HTTP(S) proxies.
• ❌ Performance.now - desc. tbd (red pill)
• ❌ WebGL profiling - desc. tbd
• ❌ Client Hints - desc. tbd
• ❌ Behavior Detection - desc. tbd (events, params, ML+AI buzz)
• ❌ Font fingerprinting - desc. tbd (list+version+renderer via HTML&canvas)
• ❌ Network Latency - desc. tbd (integrity check: proxy det., JS networkinfo, dns resolv profiling&timing)
• ❌ Battery API - desc. tbd
• ❌ Gyroscope and other (mostly mobile) device sensors - desc. tbd

Multilogin, Kameleo and others 💰🤠

tbd (if you have an active subscription in any of these services and don't mind sharing an account drop me an email ❤️)

Support

If you have problems with scraping specific website, write me a short email at dniespodziany@gmail.com. Let's have a quick tête-à-tête consultation via Skype 😊. I worked for quite some time with anti-bot detection WAFs and I am happy to help for a tip.

Leave ⭐ and a tip ➡️ Ethereum address 0x380a4b41fB5e0e1EB8c616eBD56f62f8F934Bab6