my.remarkbox.com

unverified 6y, 286d ago

Starting ChromeDriver 2.34.522940 (****) on port 42689 Only local connections are allowed. Jan 08, 2018 1:55:23 PM org.openqa.selenium.remote.ProtocolHandshake createSession INFO: Detected dialect: OSS

<title>Chrome Headless Detection</title> <style> td:last-child { background-color: #c8d86d; max-width:300px; word-wrap:break-word; } td.failed { background-color: #f45159; } table, th, td { border: 1px solid black; } </style>

<tbody> <th>Test Name</th> <th>Result</th> </tbody>

User Agent	"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.50 Safari/537.36"
Plugins Length	0
Languages
WebGL Vendor	Google Inc.
WebGL Renderer	Google SwiftShader
Hairline Feature	present
Broken Image Dimensions	16x16

remark

Starting ChromeDriver 2.34.522940 (**********) on port 42689
Only local connections are allowed.
Jan 08, 2018 1:55:23 PM org.openqa.selenium.remote.ProtocolHandshake createSession
INFO: Detected dialect: OSS

<html xmlns="http://www.w3.org/1999/xhtml" class=" hairline"><head>
    <title>Chrome Headless Detection</title>
    <style>
      td:last-child {
        background-color: #c8d86d;
        max-width:300px;
        word-wrap:break-word;
      }
      td.failed {
        background-color: #f45159;
      }
      table, th, td {
        border: 1px solid black;
      }
    </style>
  </head>
  <body>
    <table>
      <tbody><tr>
        <th>Test Name</th>
        <th>Result</th>
      </tr>
      <tr>
        <td>User Agent</td>
        <td id="user-agent">"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.50 Safari/537.36"</td>
      </tr>
      <tr>
        <td>Plugins Length</td>
        <td id="plugins-length" class="failed">0</td>
      </tr>
      <tr>
        <td>Languages</td>
        <td id="languages" class="failed"></td>
      </tr>
      <tr>
        <td>WebGL Vendor</td>
        <td id="webgl-vendor">Google Inc.</td>
      </tr>
      <tr>
        <td>WebGL Renderer</td>
        <td id="webgl-renderer">Google SwiftShader</td>
      </tr>
      <tr>
        <td>Hairline Feature</td>
        <td id="hairline-feature">present</td>
      </tr>
      <tr>
        <td>Broken Image Dimensions</td>
        <td id="broken-image-dimensions">16x16</td>
      </tr>
    </tbody></table>
    <script src="modernizr.js"></script>
    <script src="chrome-headless-test.js"></script><img src="https://intoli.com/nonexistent-image.png" />

</body></html>

unverified 6y, 234d ago

I think you have a typo Retina/HiDPI Hairline Feature. when you overwrite and redefine the property it should be HTMLElement.prototype and not HTMLDivElement.prototype where the word Div is the difference.

Awesome article btw!

remark

evan 6y, 232d ago

Thanks! You could overwrite it more generally on HTMLElement as you mention, but the bypass was developed to fool a specific test that was only checking on a div element. Making it more specific reduced the chances of interfering with the behavior of other types of elements.

remark

unverified 6y, 174d ago [edited]

You should really fix the webgl snippet as it doesnt work to:

  const getParameter = WebGLRenderingContext.prototype.getParameter;
  WebGLRenderingContext.prototype.getParameter = function (parameter) {
    if (parameter === WebGLRenderingContext.prototype.VENDOR) {
      return 'WebKit';
    }
    if (parameter === WebGLRenderingContext.prototype.RENDERER) {
      return 'WebKit WebGL';
    }
    return getParameter.call(this, parameter);
  };

remark

evan 6y, 128d ago

The code developed here is designed to work with a specific set of test bypasses. Different websites will likely be using different tests. If that's the case, then you need to figure out what they're doing and generalize the concealment code to work for those sites.

remark

unverified 6y, 146d ago

Dose not work with taobao/alibaba, it detects the puppeteer as well.

remark

evan 6y, 128d ago

The code developed here is designed to work with a specific set of test bypasses. Different websites will likely be using different tests. If that's the case, then you need to figure out what they're doing and generalize the concealment code to work for those sites.

remark

unverified 6y, 130d ago

Using this way to open https://summitracing.com. But it not work :-?

remark

evan 6y, 128d ago

You'll need to figure out what tests they're using, and adapt the code to that specific site.

remark

unverified 6y, 115d ago

Hi, do you have a node version of your script?

remark

evan 6y, 114d ago

There's a followup to this post called It is not possible to detect and block Chrome headless that uses node with Puppeteer to inject the test bypasses. That might make an easier starting point for you.

remark

unverified 6y, 87d ago [edited]

I was looking at your post on StackOverflow, I guess you never got the Chrome Extension to work and instead decided to inject it the JavaScript via MitmProxy? I'd like to know if you've found anything otherwise before I spend my time with the Chrome Extension route.

EDIT: I'm talking about Chrome regular, not Chrome Headless

remark

evan 6y, 86d ago [edited]

I'm not sure which post you're referring to, but using a Chrome Extension works fine as long as you don't need to use Chrome in headless mode. The one trick there is that you need to inject a script tag in order to break out of the extension's content script context. We've had a number of questions about this pop up lately, so I might put together a small guide with working code.

remark

pxVn9nB9 6y, 53d ago [edited]

Hi, Thank you for this. I just wanted to know if there are any harmful effects or issues that might occur if and when we change the user agent in the Chrome Headless browser initialisation. Will this work without causing any problems while using the tool?

remark

evan 6y, 51d ago

It shouldn't cause any problems with Chrome in either headless or non-headless modes. One thing to keep in mind is that bot-mitigation services might check that the user agent is consistent with the rest of the browser fingerprint. We actually just released a library called User-Agents that makes it really easy to generate random user agents and consistent browser fingerprints. You might want to check that out!

remark

unverified 6y, 17d ago

Hi, do you know of a way to conceal navigator.webdriver variable? This seems to be what's being used to catch headless and even vanilla chrome sessions that are being controlled by a third party.

remark

evan 6y, 17d ago

Sure, check out the followup to this article called It is not possible to detect and block Chrome headless. That includes instructions for concealing navigator.webdriver.

remark

unverified 6y, 10d ago

You are not correct, bro. And you don't know how the actual company like Facebook, Amazon can detect that way that you today present to us. If you want to discuss with me about that, you can see my email.

remark

evan 5y, 319d ago

The bypasses described here are designed to address a very specific set of tests that were posted in a blog post about detecting headless Chrome. Different companies will use different fingerprinting suites, and more sophisticated bypasses are required to address many of the tests that you see in the wild. The idea behind this post isn't that these bypasses are some magic bullet; it's that the party controlling the browser is always going to be able to modify browser fingerprints before external fingerprinting code runs.

remark