Spoofing canvas and webgl
- Thread starter MarkWilson
- Start date
MarkWilson
Regular Member
- Mar 16, 2014
- 307
- 93
This is some interesting info. I've already set the max touchpoints in navigator, ismobile=true (this is already available in puppeteer) and other stuff but seems I have to research on this thing too.
I contacted their support, asked them how their software performs with recaptcha and antibots.
their answer: sometimes it doesn't work with recaptcha (I guess they mean it gets detected) and they said they don't know what is distil network.
well, enough said for a 3000$ software + 100$ per month.
social engineer
BANNED
- Mar 30, 2010
- 637
- 568
Unless you trust the program fully that's one hell of a way to install a root kit on your system.
Social media will get harder over the next few months because its an election year of course if you were in a country with no computer security laws and were botnets are legal it would be a very simple way of having new fingerprints.
DaPromo
Regular Member
- Jan 10, 2017
- 328
- 168
I do not have experience with Pupeteer but I am well aware what it is.
I see they have touch event support so maybe explore that. You should be able to disable mouse emulation too as most developed frameworks has this feature.
https://github.com/puppeteer/puppeteer/blob/v3.1.0/docs/api.md#class-touchscreen
Events like this is just one way advanced anti-botting system has
jokowi
Regular Member
- Aug 27, 2014
- 339
- 109
Its too bad then, share here if yoi have better software
Good (but not good at the same time) that i'm not the only one that's found this difficult
And the problem with stealth browsers is that profiling is getting more and more advanced. I've tried before and everytime it looked like a success, it was checked against alternates profile and seemed to always produce the same two problems:-
1) although the session appeared to be legit, it was recorded that I was using yandex browser even though the strings were for chrome, firefox etc
2) some of the the plugins were defined in russain. Fucking russian even though the attributes were american. Still looking for a browser that will actually work as intended
Edit: that deviceinfo site is terrible, everything is either unresolved or undetected and it's accusing me of spoofing when i'm really actually not. Like I tried with an iphone and an ipad without any funny business, how hard can it be
And the problem with stealth browsers is that profiling is getting more and more advanced. I've tried before and everytime it looked like a success, it was checked against alternates profile and seemed to always produce the same two problems:-
1) although the session appeared to be legit, it was recorded that I was using yandex browser even though the strings were for chrome, firefox etc
2) some of the the plugins were defined in russain. Fucking russian even though the attributes were american. Still looking for a browser that will actually work as intended
Edit: that deviceinfo site is terrible, everything is either unresolved or undetected and it's accusing me of spoofing when i'm really actually not. Like I tried with an iphone and an ipad without any funny business, how hard can it be
Last edited:
greydingo
Junior Member
- Dec 31, 2014
- 152
- 73
That's an interesting point. I have no doubt you're right about that.
I'm sure things will get even harder considering it's an election year, and all the election influencing botting that happened last year.
MarkWilson
Regular Member
- Mar 16, 2014
- 307
- 93
Alright yes, playwright has a similar thing called "isMobile" which enables touch events, I am using it hope it's enough for touchscreen detection.
Although I did find some good softwares for anonymity (and maybe antidetect V8 is one of these) I didn't find any reliable solution for botting.
That's why I decided to start coding myself
Maybe with iPhones it gets buggy, but in general I never had big problems with that. keep in mind even websites like f.vision sometimes fail, you just have to take it as a referenceEdit: that deviceinfo site is terrible, everything is either unresolved or undetected and it's accusing me of spoofing when i'm really actually not. Like I tried with an iphone and an ipad without any funny business, how hard can it be
sockpuppet
Junior Member
- Nov 7, 2011
- 183
- 175
this is the way to go. and it doesn't matter if the code is obfuscated or not, you only need to harvest the api calls to the canvas/webgl api. then "replay" these calls to random visitor and save the complete canvas. you then return that saved data to the fingerprint script when it wants to read a canvas.
also adding random noise is complete useless. for example canvas fingerprint often uses the difference in font drawing and the area of the text is known. changing any pixel outside of that is easy to detect. you should atleast use some edge detection algorithm and only change pixels on an edge.
greydingo
Junior Member
- Dec 31, 2014
- 152
- 73
How would you suggest going about "harvesting" the api calls? That's a good idea. Just more details on implementation would be appreciated by everyone I'm sure.
I suppose you could replace the browser functions for the canvas/webgl that get called by the script with your own functions, and then analyze what's happening there.
MarkWilson
Regular Member
- Mar 16, 2014
- 307
- 93
interested too, I have 0 idea on how to proceed for this. Should I host the .js on a website and surf it with my bot in order to check the responses?
social engineer
BANNED
- Mar 30, 2010
- 637
- 568
you copy JS and just modify the JS to change the window.location param to the site you're trying to spoof as most anti bot technology with inclue window.location as part of their hash.
greydingo
Junior Member
- Dec 31, 2014
- 152
- 73
I think sockpuppet was just proposing an idea. I'm not sure whether he's given any thought on how to accomplish such a thing.
(I mean no disrespect, just saying, sockpuppet if you want to comment with ideas on how to go about what you mentioned that would be great).
Here would be my initial approach.
Honestly I'm not familiar with the canvas api myself, but I'll give an example of how you could theoretically analyze what the script was doing.
We'll use console.log as an example, but in reality, you would want to overwrite canvas related functions:
// create a reference to the original function
let oldLog = console.log;
// replace console.log with your own custom function
console.log = (text) => {
// analyze the function argument here, or simple log that it was called
oldLog("My custom log function called");
// then do what the original function did
oldLog(text);
}
The script that called your custom function is none the wiser.
(I mean no disrespect, just saying, sockpuppet if you want to comment with ideas on how to go about what you mentioned that would be great).
Here would be my initial approach.
Honestly I'm not familiar with the canvas api myself, but I'll give an example of how you could theoretically analyze what the script was doing.
We'll use console.log as an example, but in reality, you would want to overwrite canvas related functions:
// create a reference to the original function
let oldLog = console.log;
// replace console.log with your own custom function
console.log = (text) => {
// analyze the function argument here, or simple log that it was called
oldLog("My custom log function called");
// then do what the original function did
oldLog(text);
}
The script that called your custom function is none the wiser.
greydingo
Junior Member
- Dec 31, 2014
- 152
- 73
A couple things to note about my previous idea:
- The antibot script could have already replaced methods with it's own methods, to detect whether you were trying to do this.
- Another possibility to prevent that would be if they took a hash of the function, so that they could tell that it changed. I'm sure there's probably a way to do that.
I was hired to work on a supreme bot one time, and I can say for sure, that some antibot scripts (in this case supreme) will replace commonly used browser functions with their own, to screw you up.
For example: document.getElementById
- The antibot script could have already replaced methods with it's own methods, to detect whether you were trying to do this.
- Another possibility to prevent that would be if they took a hash of the function, so that they could tell that it changed. I'm sure there's probably a way to do that.
I was hired to work on a supreme bot one time, and I can say for sure, that some antibot scripts (in this case supreme) will replace commonly used browser functions with their own, to screw you up.
For example: document.getElementById
sockpuppet
Junior Member
- Nov 7, 2011
- 183
- 175
Yes, that is how you do it when you approach it on the javascript level. You start with a custom document.createElement that returns a custom canvas with a modifed getContext. And your returned context logs all the calls.
But that won't work if the fingerprint script looks for changed functions, then you either have to patch the script or log everything with a custom chromium build, that method is not detectable.
MarkWilson
Regular Member
- Mar 16, 2014
- 307
- 93
Those are some nice hints guys, thanks! I will need some time to understand this, as I said I'm not really a programmer.
In the meantime, I discovered that android devices use OpenGL ES as renderer. That means that if I am able to render through that engine, webgl and canvas should be the same as a mobile phone!
Please correct me if I'm saying bullshits, I just had a quick look at it late at night. What about using this thing https://github.com/google/angle in order to render canvas and webgl like real android devices?
I still have no clue on how to implement such thing in puppeteer/selenium, but if I understood correctly all the API calls will be translated from OpenGL ES to DirectX 11 which could result in a perfect emulation of webgl and canvas values.
What do you think about it?
I also discovered that passing the argument --disable-gpu in the browser context hides my actual GPU, showing google swiftshader which is much less unique and fingerprintable.
Tested it with browserleaks Webgl and Canvas pages
By the way 99% of android phones seem having the exact same canvas and webgl values. This is very good because if I am able to render on an emulated android GPU those fingerprints will be completely solved without much hassle.
In the meantime, I discovered that android devices use OpenGL ES as renderer. That means that if I am able to render through that engine, webgl and canvas should be the same as a mobile phone!
Please correct me if I'm saying bullshits, I just had a quick look at it late at night. What about using this thing https://github.com/google/angle in order to render canvas and webgl like real android devices?
I still have no clue on how to implement such thing in puppeteer/selenium, but if I understood correctly all the API calls will be translated from OpenGL ES to DirectX 11 which could result in a perfect emulation of webgl and canvas values.
What do you think about it?
I also discovered that passing the argument --disable-gpu in the browser context hides my actual GPU, showing google swiftshader which is much less unique and fingerprintable.
Tested it with browserleaks Webgl and Canvas pages
By the way 99% of android phones seem having the exact same canvas and webgl values. This is very good because if I am able to render on an emulated android GPU those fingerprints will be completely solved without much hassle.
Last edited:
greydingo
Junior Member
- Dec 31, 2014
- 152
- 73
This stuff about OpenGL ES and angle sounds interesting. I'll have to look into it more when I get some time.
Where are you getting this 99% statistic? That doesn't seem realistic to me. Do you have a source?
Where are you getting this 99% statistic? That doesn't seem realistic to me. Do you have a source?
Sebastiann
Junior Member
- Apr 27, 2020
- 182
- 243
I push all my Puppeteer scripts though Multilogin if that helps.
Make sure you run puppeteer-extra (instead of puppeteer) with puppeteer-extra-plugin-stealth as well as the v5 beta of Multilogin and I've encountered zero tests that can detect this combo.
Make sure you run puppeteer-extra (instead of puppeteer) with puppeteer-extra-plugin-stealth as well as the v5 beta of Multilogin and I've encountered zero tests that can detect this combo.
MarkWilson
Regular Member
- Mar 16, 2014
- 307
- 93
Actually I just took 5 phones (mine and from some friends) which are totally different models (Huawei, Xiaomi, OnePlus, Samsung) and they all had EXATLY the same hash value on browserleaks and also here with picasso canvas:
https://antoinevastel.com/browser fingerprinting/2019/03/21/picasso-canvas-fingerprinting.html
Just try yourself, check with different phones (makes sure they are all android) you should get the same exact value.
I was surprised too (but also happy) when I saw they all had same hash
Last edited: