Bypassing website anti-scraping protections
kb.apify.com
kb.apify.com
300 is pretty easy to achieve if you're "Googling hard enough" (make 5 slightly different queries, go through the 20 pages of results it's willing to show you, repeat 3 times...), and I've seen it trigger far before that if you are searching for more obscure things. It seems almost hostile to those searching for IC part numbers, specific and very exact phrases, and just "non mainstream" content in general.
How sad it is then, that we are told and have internalised the notion that we should use search engines like Google to find things, and yet it prevents us from "trying too hard" to find what we're looking for...
But that is why they only show recaptcha, you fill it in and you will get extemption cookie for 30 more requests :D
Does that actually work? Whenever I have been searching some obscure things and managed to get the captcha after 6-10 pages, it just goes to loop where it keeps giving it constantly. Though it stops giving it if I change the search terms.
To do this from DDG, prepend your search using !g to search Google
Due to recent events it seems they got scared, locked down their API, then tightened down the request limit to prevent scraping to the point it is hardly usable on desktop anyway.
It looks like it just hits https://www.instagram.com/graphql/query/... every time you scroll down so if you scroll too fast it just hammers it and throttles your requests to that endpoint.
Note id of user (e.g. 1954202703). this is the "id": value in the url.
Note end_cursor. This is used for the "after": value in the url
Note rhx_gis. This is used to create the "X-Instagram-GIS:" header.
Looking at archive.org, it seems as recently as last year, end_cursor was once all that was needed.
2. Fetch js from ProfilePageContainer url in 1st page (e.g., https://www.instagram.com/static/bundles/base/ProfilePageCon...)
Note queryId (e.g. 42323d64886122307be10013ad2dcc44)
This is used for "query_hash" in the url.
3. Create header "X-Instagram-GIS:"
Apparently this is some MD5 hash of rhx_gis and the query string variables according to this source:
https://www.diggernaut.com/blog/how-to-scrape-pages-infinite...
However a little experimentation revealed that generation of rhx_gis or this hash must also incorporate the user-agent string -- change any character in the user-agent string and the request will fail.
They also put IP address and a Unix time value in a cookie but the cookie can be deleted and the request still succeeds.
For example the final url for the first 12 photos is:
https://www.instagram.com/graphql/query/?query_hash=42323d64...
Overall, seems not too much work for someone who really wants to automate retrieval of Instagram photos. These requests for successive groups of 12 can be RFC 2616 pipelined over a single connection. Not long ago and for some number of years, it was even easier (e.g. just use end_cursor value as "max_id" in url).
That said, automated research fascinates me, I wouldn't want to scrape Google to make my own Google, but rather to make private repositories of information that I can then query efficiently. I would love to find any kind of scriptable search engine access, paid or free. Not entirely sure how to look though.
No matter how well-intentioned you are, if you write your own scraper and have it abide by robots.txt, you'll never get nearly as many resources as Google or Bing. Many websites approve only their scrapers and ban everything else outright.
I don't have anything against the large search engines, it's just not really easy to say no to their scrapers for most websites.
That word, I don't think it means what you think it means.
I don't think that making a scraper will make you competitive with Google. If you can make a site ranking algorithm that compete's with google, on the other hand, you might have a chance
Er, ughm. I mean,
Ding ding ding!
The one reason Google is competitive is due to them taking advantage of the cheap labour that keeps track of ranking manipulation.
Luckily most of the search problems have nothing to do with ranking manipulation.
From one side it's along the natural-language interface from Alexa or alike; from the other side it's an interface of search for people who generally need access to information.
If Google exposed interfaces similar to Elastic Search - the search would never be an issue anymore; but it would not be easy to use by the users.
You and me both :)
I still haven't gotten around to do much about it, but for example one thing I've been thinking about is to have my system integrated with my desktop so that it has some situational context.
For example, it would look at the programs that I have currently running.
Let's say that it saw that I had PyCharm open where I was editing some Python 3 files. Furthermore I also had Vim open where I was editing some HTML, CSS and JavaScript files.
It would maintain a list of all items that had been in focus during the previous 30 minutes or something.
When I then searched for let's say sort list it would look at the list and see that most recently I had been editing a Python file in PyCharm so result number 1 would be how to sort a list in Python 3. Before that I had also focused Vim with a JS file, so sorting arrays in JS would be result number 2.
Results:
1. Python 3. Sort list "a_list". In-place: a_list.sort(). Build new sorted list from iterable: b_list = sorted(a_list).
2. JavaScript. Sort array "an_array". In-place: a_list.sort(). Create a new shallow copy and sort array: let another_array = an_array.concat().sort().
And if the system was even smarter, it would also be able to know details about what I'd been doing. For example it could see that while editing a JavaScript file I had most recently been writing code that was doing some operations with WebGL, and before that I was editing code that was changing style properties and before that something that was working with Canvas, so if I then search for blend, it would use this information.
Results:
1. WebGL Lesson 8 – the depth buffer, transparency and blending. http://learningwebgl.com/blog/?p=859
2. Basics of CSS Blend Modes. https://css-tricks.com/basics-css-blend-modes/
3. CanvasRenderingContext2D.globalCompositeOperation. https://developer.mozilla.org/en-US/docs/Web/API/CanvasRende...
Something like that.
And because it's for the limited amount of things that I am interested in and developed for myself only (as opposed to trying to give super relevant information for every person in the world), it might be doable to some extent.
Here is a book that might be of interest to you; Relevant Search. https://www.manning.com/books/relevant-search. I bought a copy myself but have yet to read it.
They cannot. Googlebot & some other search engine bots (like Bing's & Yandex's) get special treatment in various websites. This includes things like ban on non-whitelisted scrapers & bypassing paywalls. If you are not already established player in the field, you would not get able to scrape the same websites as the established players can.
Basically it was anti competitive to grant certain privileges to major players around 'public data,' but to block smaller players.
No telling if/when ramifications from that decision (last year) hit existing anti scraping measures, though.
Unfortunately that is not the case. Many paywalled sites will let googlebot index their content but block other crawlers.
They may have good reasons for doing that in some cases, but as a consequence the level playing field you're talking about no longer exists.
Also, the purpose of using Google as part of some automated process is usually not to compete with Google's search engine, but to complete some specific and limited task.
I don't understand why Google does not have a general search API offering. I'm sure many people would happily pay for it.
A search monopoly is not good for website owners. It makes us very dependent on the whims of that monopolist.
If you block all crawlers that don't already have a large market share and send back a lot of traffic, you're killing any possibility for new competitors to get a foot in the door.
Also, you're killing any chance for something unexpected to happen, such as someone having a great idea based on crawled data that could change all our lives for the better without ever sending traffic to your site.
Now, I'm not telling you what you can and cannot afford. If crawlers cost me a ton of money that I don't have I would certainly act exactly like you suggested.
Very true. Only allow Google and you are helping them to build their monopoly. And if they have full monopoly they do what they want - including asking you money to be included in the search results.
Doesn't that infringe upon Google's own rules? I always thought Google didn't like it when sites served its crawler content that's different from what users get when they follow Google's link.
But it no longer works at all sites. Maybe the rule has been dropped now that paywalls are becoming more popular (with publishers that is)
I think bing is close to Google in quality. Some people might even like it better. On the other hand I think DDG is the Sprint of search engines.
Google used to have a search API and they discontinued it because they said most of the people who used it were SEO people.
People who do pay-per-click are into A/B testing and other quantitative testing. Google is all for you doing that if you pay for advertising. Their mainstay of anti-SEO is doing arbitrary and random things to make it impossible for SEOs to go at it quantitatively. (They have patents on this!)
One reason so many sites go to a harvesting business model is that once a site is established you can make the slightest change and then your search rankings plummet. If you depend on search engine traffic it is a huge risk that you can't do anything about unless you are about.com (bought a 'competitive' search engine and just might be able to make an antitrust case against Google.)
I've been interested in switching to DDG for a while but as a former Sprint customer, that statement scares me but maybe some explanation from you might understand your opinion better.
Often I do get a good result on the first page but often results #1-#N vary from third rate to non-sequitur and then result #N+1 is the one that should be at #1, where maybe N is drawn from Uniform(3,6). I see this so much I can't imagine it is an accident. If anything it seems to be 70% more evil than Google.
The real difference is non-technical things. Google filters out unflattering results and one side of anything even remotely political. It's a nerfed world, kind of like a Disney theme park. I'm an adult and I don't need to be led with blinders to the googly viewpoint.
Isn't DDG just a Bing wrapper with a few frills in the results?
He is not selling advertising.
He is not even running a public website.
Google is preventing you from using automation to create private (i.e. personal) respositories of information, even when that information is public and (ironically) Google itself relied on automation ("bots") to collect it.
That's what Apify in original post does - including a public database of scrapers, so there is a high chance you could use already finished scraper :).
Despite the fact that the entire site was available in an easy to scrape XML format, scrapers kept using the search feature.
They were trying very hard to overcome my countermeasures--they had a seemingly limitless pool of IPs, they were rotating user agent strings, and they tried to randomize search behavior.
Everytime I implemented a new countermeasure they'd try to find a way around it. It was maddening because we made everything available for them through the XML feed. They just wouldn't use it.
It's bad that not everyone works like this; there are quite a lot of people who would rather brute-force a solution than think about it.
Not unexpected I guess.
They weren't getting any information that they couldn't get through the XML.
It may have been better to just publish the site in HTML format with an easy to find link on front page to access it.
Eli Grey and I have bypassed your "hideWebDriver()" function[1] in a single line of code:
if (navigator.webdriver || (Navigator.prototype && Object.getOwnPropertyDescriptors(Navigator.prototype)["webdriver"])) {
// Chrome headless detected - navigator.webdriver exists or was redefined
}
I've found the practice of looking at search-term frequency, across a domain or set of domains (using the "site"<domain>" Google search filter) to be useful, for example the "Top 100 Global Thinkers" report linked below.
It uses 100 search terms -- "global thinkers" identified by Foreign Policy magazine -- searched across a set of about 100 domains and TLDs, largely social media, various journalism (newspaper / magazine), and a few institutional sites, as well as selected national and other top-level domains. The result is an interesting profile of where more robust online discussion or commentary might be found.
https://www.reddit.com/r/dredmorbius/comments/3hp41w/trackin...
The full report requires running roughly 100 x 100, or 10,000, Google searches. I'm finding that it's necessary to space these ~5-10 minutes apart, which means that the full analysis takes over a month of wall-clock time, from a single IP.
I've considered several possible follow-ups to this study, including more or alternate domains, different keywords, and various other variants, but both the run-time and codeing to bypass bot-detection put me off this.
I've tried reaching out to Googlers I know to see if there's any possible alternative means of acquiring this information, to no avail. I've also looked for various research interfaces or APIs, with no joy.
DuckDuckGo and other search sites don't have the rate-limiting (I've used them for other purposes), but also don't have the (granted, often very inaccurate / imprecise) match-counts which Google offers.
Putting this out there both as an example and a request for suggestions as to how I might improve or modify the process.
The ArchiveTeam[1] have a simple VM image that anyone can use to schedule and coordinate large site archival jobs that might already address some of teh issues.
Might be tricky to find people willing to provide resources, but with even a smallish group it might work out. May need to consider abuse and run multiple queries and compare results, which might add to the overall request cost.
My approach is sufficiently fluid that this would mean pushing pretty crude code to a bunch of hosts frequently and on a irregular basis. The runs themselves are fairly ad hoc.
Being able to directly query a corpus (IA, DDG, Bing, etc.) is another option.
Search across large corpora remains fairly expensive, I can understand hesitency here.
Nonstandardisation of search APIs across sites is another frustration.
¹ in the sense of owned by the State, not listed on the stock market
As for the commonality of principles, game theory explains most of them, so it isn't more surprising than that we all work with the same prime numbers, say. A simple principle of reciprocity will produce something along the lines of "respect other people's wishes".
I can't say I agree. I mean, a serious, interesting essay can certainly be written on the ethics of scraping. But these short preludes on technical posts just end up sounding either like a disingenuous legal disclaimer or a preachy paternalistic tirade.
For example, the Linkedin case : https://arstechnica.com/tech-policy/2017/08/court-rejects-li...
Craiglist sued some companies too.
To my understanding, scraping can be legal if it's done properly, meaning not sending too many requests at the same time, and if it does not affect the underlying infrastructure.
It seems like in the US or in Europe, even if there is any anti-bot / anti-scraping section in the website's TOS, public data can be scraped. Sometimes, even "private" data can be extracted using bots. For example, lots of "bank account aggregators" has won lawsuits against banks.
The reality is that the CFAA is extremely broad and if we want to protect "scraping", better termed something like "data preservation" or "data recovery", we need to change the CFAA, copyright, and the applicability of EULAs (which effectively work to plug any tiny leak that someone may've found through the CFAA-copyright combo).
Copyright itself makes it effectively illegal to read a web page without the owner's consent, even if a) there is no trespass/unauthorized access (CFAA); and b) there is no infringement in the actual content extracted. This occurs because the markup and other necessary supporting material around a page is a copyrighted work, and just reading it into memory and then immediately discarding is considered sufficiently tangible to infringe on the copyrighted work.
This is called the "RAM Copy Doctrine", and it has been [mis]applied to scrapers many times. In Facebook v. Power Ventures, it was used to stop a startup from helping Facebook users extract their own content. That founder was left owing $3M in damages to Facebook.
LinkedIn v. Hi5 is the most notable recent exception, but those rulings seem to be pure judicial activism unsupported by precedent or really any legal underpinnings, and will surely be overturned on appeal.
For every high-profile LinkedIn v. Hi5-style success, there are a good number of losses. It is fairly routine now after 3Taps.
IANAL, but my SaaS business, which depended on a key piece of scraped data, was destroyed by a legal threat from a Fortune 100.
Does anyone know what exactly the property in question is?
https://antoinevastel.com/bot%20detection/2017/08/05/detect-...
https://antoinevastel.com/bot%20detection/2018/01/17/detect-...
But you are right, after reading through it again, this section of the article should be improved.
But there are totally legitimate reasons to scrape as well. Altmetric (https://www.altmetric.com), which is the company I work for, tracks links to scientific research. So when someone on e.g. Twitter links to a page on nature.com, we want to scrap the page they linked to and figure out which paper they are talking about (if any). Academic publishers can be particularly sensitive to scraping, making the endeavour much more work than it needs to be.
It's a real shame that the web has moved to be so closed off in many ways.
Writing a site-specific browser has always been a fun project for me. It just pulls the information I want directly from my favorite websites. Maximum signal-to-noise ratio and I get ad blocking for free.
People think Javascript-based sites are safer, but it's in fact even easier to access the content because there's usually a programmatic interface available.
For dynamic sure puppeteer if you have too but my god the exceptions and stack traces need some work.
But most websites don't enact protections because it's generally not worth the opportunity cost. So you really just scrape with your LOC.
If you move money or can't code then mozenda.
I have checked few solutions out there, I am using now proxycrawl. Developers of their api helped me get a very high volume of Serp data from different search engines like Yandex, google and yahoo and bing. I also use them for Javascript crawling as for our project we need lots of content which is rendered via javascript. I am amazed of how their API endpoint works. It is basically sending a URL to their API and you are good to start. Make sure to contact them for some sites as they do not allow you to crawl the world by default unless you prove your use case, they liked my product and that is how it got started. I've really having successful experience with it so I totally recommend, you basically communicate with developers who does lots of work to make it happen. As I am mainly in JS I asked for a Node JS package and they just built it open sourced. https://github.com/proxycrawl/proxycrawl-node