Need to bypass Distil Networks

[badasscoder]

Anybody here has experience on bypassing Distil Networks Antibot Security? We are working on a ticketing bot and the distil is doing funny things with our requests.

 

[thetrustedzone]

what you are using ? Selenium web driver ?

 

[badasscoder]

No... Direct http requests.

 

[BetterKnow]

This is not gonna happen without a headless browser to deal with all the fingerprinting, there's too many variables to worry about with requests.

 

[badasscoder]

But they block selenium anyway... How can headless work with distil?

 

[thetrustedzone]

there's frameworks to automate the desktop itself not the web , try to automate the normal browser itself -I know it's more difficult - but no way in this case for distil to know it's automated since all done locally .

btw tried other web frameworks like chromium ?

 

[BetterKnow]

But they block selenium anyway... How can headless work with distil?

They can't "block" selenium, they just block sessions that act like selenium. You'll need to change the behavior of the browser to make it act like a regular user.

 

[badasscoder]

They can't "block" selenium, they just block sessions that act like selenium. You'll need to change the behavior of the browser to make it act like a regular user.

That's not true. They can and they do.

 

[verrocchio]

Badasscoder is right, they can and probably do detect selenium because there are references in the global context that give it away, however, as much as I am against it I have to recognize that translating the code actually works. A few weeks ago reverse engineered a pretty big anti bot system for a client and with the proper mix of instrumentation and sampling a "translated" version was made and it's working flawlessly.

Could you share a sample target url badasscoder? I'd like to check the system myself.

 

[adverts]

That's not true. They can and they do.

Anything that relies on client side detection is worthless. The only thing worth it' salt as a bot detection tool is one that performs behavior analysis. Those are much harder to bypass. Distil protected sites do not implement that level of heuristics/analysis.

 

[GoGuerilla]

Imagine 'badasscoder' who quoted me a ton of money to create some stuff not knowing that Selenium cannot be blocked if used properly..

 

[BetterKnow]

Imagine 'badasscoder' who quoted me a ton of money to create some stuff not knowing that Selenium cannot be blocked if used properly..

Welcome to the internet

 

[social engineer]

Imagine 'badasscoder' who quoted me a ton of money to create some stuff not knowing that Selenium cannot be blocked if used properly..

This is BHW its called praying on the noobs

@badasscoder
Have you analysed the anti-bot code at all?
being a ticketing bot is the anti-bot code only up for a few minutes when there is a ticket release?
For sheer speed, you're right requests would be a far better option but chances are they're doing canvas and web-gl fingerprinting which requires a bit more work to play around with but its a golden age for bots at the moment! Wait till wasm is used for bot detection that will really separate the wheat from the chaff.

If the antibot code is anything like supremes current pooky there will be a lot of anti-debugging functions in it. Half the effort in writing a bot with decent antibot detection is writing the programs to de-obfusicate the antibot js.

 

[GoGuerilla]

This is BHW its called praying on the noobs

@badasscoder
Have you analysed the anti-bot code at all?
being a ticketing bot is the anti-bot code only up for a few minutes when there is a ticket release?
For sheer speed, you're right requests would be a far better option but chances are they're doing canvas and web-gl fingerprinting which requires a bit more work to play around with but its a golden age for bots at the moment! Wait till wasm is used for bot detection that will really separate the wheat from the chaff.

If the antibot code is anything like supremes current pooky there will be a lot of anti-debugging functions in it. Half the effort in writing a bot with decent antibot detection is writing the programs to de-obfusicate the antibot js.

Little bit off topic here but can you please elaborate on wasm curious to know more ! Take it to PM's if you'd like.

 

[social engineer]

Sorry GoGuerilla, Wasm is shot for Web Assembly.

https://webassembly.org/

In effect you'd have to reverse C++ / Rust / Go Binaries inorder to find/remove the anti-bot detection.

If you want to know more feel free to PM me.

 

[Pistacho]

They can't "block" selenium, they just block sessions that act like selenium. You'll need to change the behavior of the browser to make it act like a regular user.

This is utterly wrong. Selenium can be detected, it has been known for ages.

If you need to absolutely use a browser because you can't reverse engineer the Javascript then at least use something else that launches a browser from the command line. Then from there, use something where you can send actual real Keyboard presses and Mouse clicks. At least you won't be detected as using Selenium and will pass the check they are doing to check for people using tools like PhantomJS, Selenium, etc. on their site.

 

[verrocchio]

This is utterly wrong. Selenium can be detected, it has been known for ages.

If you need to absolutely use a browser because you can't reverse engineer the Javascript then at least use something else that launches a browser from the command line. Then from there, use something where you can send actual real Keyboard presses and Mouse clicks. At least you won't be detected as using Selenium and will pass the check they are doing to check for people using tools like PhantomJS, Selenium, etc. on their site.

The thing with that is that you lose access to the DOM and most of the candy, the proper way to do it is to compile your own version of the driver and change the strings these engines use to detect it (eg. selenium, webdriver, XPathResult), then you get to keep the good stuff.

As for event generation selenium does support synthetic OS level event generation but if you don't like it you can always generate your own posting messages to the appropriate window object.

 

[BetterKnow]

This is utterly wrong. Selenium can be detected, it has been known for ages.

If you need to absolutely use a browser because you can't reverse engineer the Javascript then at least use something else that launches a browser from the command line. Then from there, use something where you can send actual real Keyboard presses and Mouse clicks. At least you won't be detected as using Selenium and will pass the check they are doing to check for people using tools like PhantomJS, Selenium, etc. on their site.

Okay Mr. Expert, thank you for teaching me

A good old saying is, an engineer's tool is a toy in a kid's hand.

 

[Pistacho]

Okay Mr. Expert, thank you for teaching me

A good old saying is, an engineer's tool is a toy in a kid's hand.

Please don't call me Mr.Expert I'm just as as you eager to acquire new skills and expand my horizon. But... I just had to call you on your innocuous lie saying that Selenium cannot be detected. Yes it can! There are various javascript enumerations you can use to detect the use Selenium.

This is not gonna happen without a headless browser to deal with all the fingerprinting

Another wrong advice to give to your fellow forum member. First, you never ever use a headless browser if you want to avoid all sort of fingerprinting. That's the whole point of having browser fingerprinting , to deter and detect bot usage through headless and/or browsing automation.

If you must use a browser then use something that has anti-fingerprinting built in. That will get you a little bit further. There is a reason why these tools are becoming more popular now.

there's too many variables to worry about with requests.

This sounds like you don't have the necessary skills to reverse engineer client side Javascript code or even look under the wire to inspect your requests with your Google Chrome Dev tools.

If that's as far as your skills goes, then it's fine, you can stop there but stop telling people to use a completely inferior method such as a headless browser when they will get stuck in a loop because they listened to someone that couldn't be bother to use better tools and increase his own skillset.

Wasm, obfuscated Javascript code is going to be the future so the era of popping the Chrome Dev tools and inspect the Http(s) requests to figure out what's going on to make a bot are long gone.

You NEED TO KNOW JAVASCRIPT and learn to manipulate it if you intend of bypassing any sort of browser fingerprint mechanism. It's called security through obscurity.

 

[social engineer]

Id argues that headless browsers have their uses they are useful when companies change their anti bot tech on the fly.

Honestly though you are best off using a custom headless browser though, the technique should always be about blending in not being unique.

Better to use headless browser than get 10k of accounts flagged as bots with a request script sometimes.