Spoofing canvas and webgl

MarkWilson

MarkWilson

Regular Member
Joined
Mar 16, 2014
Messages
307
Reaction score
93
Hi
it seems it's almost impossible to spoof canvas and webgl correctly - without getting detected as fingerprint resistance.
I tried all the available chrome extensions (canvas blocker and so on), they correctly change hash but on deviceinfo.me it is detected as spoofed.
I heard there is some people emulating those directly on real phones and devices.

I managed to spoof basic things (plugins, fonts, navigator properties, window properties) and I am having a good recaptcha score sometimes which means I am not fully detected by Google.
Still, I am being detected by distil and other major antibot services.
Any pro botter with some advices ?

general info: navigator properties are spoofed in order to match android properties as mobile phones have bigger fingerprint entropy than desktops.
I kept the same properties order and spoofed them correctly. plugins returns 0, webrtc leaks are hidden but not correctly spoofed (didn't find a way to do this) and I deleted navigator.webdriver property.
 
Last edited:
Advertise on BHW
Have you considered using a real browser (but scaling it up would be a problem nevertheless) instead of selenium? You could do that with something like pyautogui, for example.
 
Gogol said:
Have you considered using a real browser (but scaling it up would be a problem nevertheless) instead of selenium? You could do that with something like pyautogui, for example.
Click to expand...
actually I am using puppeteer/playwright right now, running headful chromium browser.
Canvas and webgl should be hardware based, so no matter which browser you use, they can be used for detection as each machine will render slightly different images.
The interesting result is that sometimes I even get 0.7-0.9 as score by Google but di.stil and da.tadome are insta blocking me.
 
MarkWilson said:
actually I am using puppeteer/playwright right now, running chromium browser.
Canvas and webgl should be hardware based, so no matter which browser you use, they can be used for detection as each machine will render slightly different images.
The interesting result is that sometimes I even get 0.7-0.9 as score by Google but di.stil and da.tadome are insta blocking me.
Click to expand...
Nevertheless, this is an awesome thread. Subbed to this. Anything related to fingerprinting is a good read. Perhaps, @jamie3000 knows something?
 
Gogol said:
Nevertheless, this is an awesome thread. Subbed to this. Anything related to fingerprinting is a good read. Perhaps, @jamie3000 knows something?
Click to expand...
thanks! I really think we should team up and discuss deep things as there is little information available on the web, not enough.
I read almost every article available out there speaking about fingerprinting and wasn't able to pass big antibots.

I can provide some distil anti bot .js to anyone willing to explore it
 
MarkWilson said:
thanks! I really think we should team up and discuss deep things as there is little information available on the web, not enough.
I read almost every article available out there speaking about fingerprinting and wasn't able to pass big antibots.

I can provide some distil anti bot .js to anyone willing to explore it
Click to expand...
Teaming up would be a great idea. I can provide some hours on the weekends too. :)
 
Gogol said:
Teaming up would be a great idea. I can provide some hours on the weekends too. :)
Click to expand...
I think we need someone who deeply understands JavaScript in order to understand which parameters are evaluated by antibot js by looking at the scripts I have collected. I am not really a programmer so I am not able to fully understand it.
 
MarkWilson said:
I think we need someone who deeply understands JavaScript in order to understand which parameters are evaluated by antibot js by looking at the scripts I have collected. I am not really a programmer so I am not able to fully understand it.
Click to expand...
I work as a frontend developer, so I do understand js a bit. :P

If you have any interesting script for me, please feel free to pm me. Let's see what it is.
 
530583e79e4fc7f75855995d511e185c.jpg
 
copy the JS that they are using for fingerprinting run an ad campaign (can be anything) alternatively set up a site and record the exact fingerprints that the site you're trying to bot is asking for.

then use these as you're finger prints you'll have a tonne of hashes of the webgl and canvas fingerprints which can easily be injected.
 
social engineer said:
copy the JS that they are using for fingerprinting run an ad campaign (can be anything) alternatively set up a site and record the exact fingerprints that the site you're trying to bot is asking for.

then use these as you're finger prints you'll have a tonne of hashes of the webgl and canvas fingerprints which can easily be injected.
Click to expand...

Sounds like a good idea in theory. But I would think much easier said than done.

I would imagine the bot detection js is obfuscated. Is it not?
 
greydingo said:
Sounds like a good idea in theory. But I would think much easier said than done.

I would imagine the bot detection js is obfuscated. Is it not?
Click to expand...
I imagine it is too, but the majority of high level botting involves debugging lots and lots of js.
 
For sure. Just pointing that out.

I do really like the idea of using their own code to harvest random fingerprints though.
 
social engineer said:
copy the JS that they are using for fingerprinting run an ad campaign (can be anything) alternatively set up a site and record the exact fingerprints that the site you're trying to bot is asking for.

then use these as you're finger prints you'll have a tonne of hashes of the webgl and canvas fingerprints which can easily be injected.
Click to expand...
I agree with @greydingo , this seems almost impossible to accomplish considering my current skills. The .js are obfuscated indeed.
also isn't the canvas/webgl hash built in real time? I mean, if you spoof those hashes you will not solve the problem, there are chrome extensions out there spoofing hashes but they are detected as fingerprint resistance.
For example I tried kknapsner's Canvas blocker and even with minimal noise levels it gets detected.

Also could you please elaborate "run an ad campaign"? What do you mean exatly?
 
What site are you trying to bot on?

yeah this method wont work for sneaker sites who have limited time releases.
 
I want to join the team too! Highly interested, finally a group of people that knows what's up!
 
social engineer said:
What site are you trying to bot on?

yeah this method wont work for sneaker sites who have limited time releases.
Click to expand...
I bot on social Networks. Instagram mainly (which is using recaptcha from Google). I am currently ok with my bot, I think it doesn't get detected because social networks have to keep a higher bot tolerance in order to not affect normal users.
But I want to be able to pass even best antibots, just for science purpose. I just love to study these systems
 
Guys I found something really interesting:

This program claims to be able to spoof even GPU and stuff by modifying window binaries, so if it works canvas and webgl will change too.
I didn't try it though, as installation seems a hell and it is used for spoofing desktop hardware.
In my specific case I am emulating mobile parameters so I won't use it, maybe someone can benefit from this.
Also it relies on virtual machines which is not the most efficient way considering resources.
AGAIN, I DIDN'T TRY IT I AM NOT RECOMMENDING IT, IT'S JUST INTERESTING
 
I see you spoof to android and using a PC.. Just remember desktop and mobile have 2 different supported properties and in javascript mobiles are registered as .touch event and desktop .click event so if you use a PC to spoof a mobile phone, advanced detection systems will be able to notice mouse movement and .click events
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top