3 ms·
Most of these techniques are extremely old and very outdated. Teams that I've seen working on apps now implement much stronger checks on APIs especially Androi
by colesantiago 2y ago
Most of these techniques are extremely old and very outdated.
Teams that I've seen working on apps now implement much stronger checks on APIs especially Android apps such as SafetyCheck and DeviceCheck and other methods, which makes using strings rather basic to see them.
And most apps are now encrypted so you just see junk in the logs.
- rozap 2y agoAnd on the web side, fingerprinting is rampant and there are JS challenges in cloudflare, imperva, etc which make it trickier. Frustrating to run a whole browser with a virtual screen, load the whole page which is ofc like 15mb of JS and other trash, just to do a very simple thing. Granted, smaller fish like the ones OP is referring to generally don't have aggressive anti automation measures in place, so it can be easy...but generally these techniques don't work if the operator has put the proper measures in place.
- skilbjo 2y agotake a look at https://xhr.dev/ https://xhr.dev/, a product I built to avoid bot detection from things like cloudflare, imperva, aws waf, and others
- imp0cat 2y agoFrustrating? Yeah! but it works SO great! I especially like Playwright in this context, it can do pretty much anything and is a joy to use.
- filleokus 2y agoIs there a drop-in "thing" for using DeviceCheck? I would guess that something like Auth0 uses it (or maybe not? [0]). It seems like this could be a feature in any API Gateway / WAF'y product? Not that I'm hoping for it, I too like to play around like OP. But I'm surprised how little I've encountered it in the wild. [0]: https://github.com/search?q=org%3Aauth0%20DCDevice&type=code https://github.com/search?q=org%3Aauth0%20DCDevice&type=code