1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Does anyone have an undetectable selenium jar?

Discussion in 'BlackHat Lounge' started by jamie3000, Aug 9, 2017.

  1. jamie3000

    jamie3000 Supreme Member

    Joined:
    Jun 30, 2014
    Messages:
    1,377
    Likes Received:
    626
    Occupation:
    Finance coder looking for semi-retirement
    Location:
    uk
    Noticing an increasing amount of websites that can detect the default selenium setup now. Probably due to the normal web driver = true check and JavaScript ($cdc + $wdc_) enumeration tricks.

    Before I go digging and testing trying to compile my own from source I wanted to just see if anyone here had one they'd be willing to share before I start on my own?

    Thanks :)
     
  2. bartosimpsonio

    bartosimpsonio Jr. VIP Jr. VIP Premium Member

    Joined:
    Mar 21, 2013
    Messages:
    12,489
    Likes Received:
    11,190
    Occupation:
    CHEAP
    Location:
    DATASETS
    Home Page:
    None that I know of. I think selenium needs these hooks in place in order to work. Are you sure they can be removed?
     
  3. jamie3000

    jamie3000 Supreme Member

    Joined:
    Jun 30, 2014
    Messages:
    1,377
    Likes Received:
    626
    Occupation:
    Finance coder looking for semi-retirement
    Location:
    uk
    I've seen people reference this

    http://www.ifroi.xyz/custom-selenium-jar-file/

    However I'm not brave enough to use it lol for obvious reasons.

    I've also seen people saying they've managed to get a version of selenium working that passes the youtube detection and distil networks detection, which seem to be the big two. By changing js and webdriver attributes.
     
  4. Sherbert Hoover

    Sherbert Hoover Jr. Executive VIP Jr. VIP

    Joined:
    Dec 26, 2010
    Messages:
    1,100
    Likes Received:
    9,211
    Occupation:
    ORM - Content - SEO - PBN
    Location:
    Anywhere but the UK
  5. jamie3000

    jamie3000 Supreme Member

    Joined:
    Jun 30, 2014
    Messages:
    1,377
    Likes Received:
    626
    Occupation:
    Finance coder looking for semi-retirement
    Location:
    uk
  6. bartosimpsonio

    bartosimpsonio Jr. VIP Jr. VIP Premium Member

    Joined:
    Mar 21, 2013
    Messages:
    12,489
    Likes Received:
    11,190
    Occupation:
    CHEAP
    Location:
    DATASETS
    Home Page:
    You're right to be skeptical. I wouldn't go anywhere near a modified binary jar like that.

    Yes. Just like regular aspirin.
     
    Last edited: Aug 9, 2017
  7. DupM

    DupM Registered Member

    Joined:
    Aug 6, 2017
    Messages:
    50
    Likes Received:
    4
    Gender:
    Male
    Custom Selenium Jar?

    I am not sure I have experienced this problem before but haven't done selenium in over a month. What do you mean detect? There is no code run on selenium. Selenium is a library that you interface with a web driver, e.g. chromedriver, firefox (gecko) driver etc.

    I don't think this is happening or you misunderstand the reason of why you are detected. If you want give me the website that detects you and I will check to see, I am really curious.
     
  8. jamie3000

    jamie3000 Supreme Member

    Joined:
    Jun 30, 2014
    Messages:
    1,377
    Likes Received:
    626
    Occupation:
    Finance coder looking for semi-retirement
    Location:
    uk
    Look up distil networks they use various js tricks to detect selenium browser automation
     
  9. DupM

    DupM Registered Member

    Joined:
    Aug 6, 2017
    Messages:
    50
    Likes Received:
    4
    Gender:
    Male
    you said some JS bullshit run, but im sure if you add some randomized actions and do your scraping smarter you can beat their ML algorithm. For these situation false positives are worse than true negatives. So you have the advantage. I don't understand what is there to complain or worry about.
     
  10. itz_styx

    itz_styx Jr. VIP Jr. VIP

    Joined:
    May 8, 2012
    Messages:
    560
    Likes Received:
    262
    Occupation:
    CEO / Admin / Developer
    Location:
    /dev/mem
    Home Page:
    any browser can be fingerprinted and so can selenium hence why its a stupid (and bloated) solution to use a headless browser. people do it just because its easy, but its not the way to go.
    raw GET/POST requests is what every professional bot uses. the only excuse to use selenium is "because im too lazy to do it properly" :p
     
  11. DupM

    DupM Registered Member

    Joined:
    Aug 6, 2017
    Messages:
    50
    Likes Received:
    4
    Gender:
    Male
    This forum is so much misinformation. How are you going to load recapatcha or other javascript heavy websites? RAW GET/POST requests? Or you are going to reverse engineer the entire javascript for each site you plan on automating to convert them to raw post/get requests? Everyone is a cheap freeloader here I am sure they will be happy to pay some developer a months worth of salary for doing that. You have no idea what you are talking about or why selenium is used.