This is Part 3 of my series of reversing ShapeSecurity's VM. I have a few more to go. This will only talk about the VM and not the signals and if you need to catch up ready part 1 and 2 that are posted on my blog.
8 karma · joined January 12, 2024
I reverse antibots for fun and profit. This is my specialty this is what I've been doing for the past 2 years, almost 3 years non-stop. This means spending a lot of time writing AST transformations scripts and tools to make things easy for me to reverse.
Currently master at reversing Javascript but beginner at reversing mobile apps.
I write in Python and especially NodeJS
There will be many more parts to come guys stay tuned.
First, your payload is being sent using base64 encoded using the default alphabet. You only need a simple atob() to decrypt your payload.
Second of all, your bot detection script is very readable making the job of the attacker relatively easy to reverse.
Third, but not least, you do not have enough signals/fingerprints which means that your false positives are going to sky-rocket.
Bots are not dumb, they are programmed by real humans, your site is extremely easy to reverse. You need to add more obfuscation, more signals, better client-side protection in order to quality for real "bot detection".
Source: I reverse antibots for fun and profit, is literally all I've been doing for the past 2 years straight.
You have things on the extreme side like people begging on tiktok live doing shoutouts to every viewer that donates a significant gift.On the IRL side you also have people donating to the craziest streamers doing the most outrageous stuff outside. Then you also have super donations on Youtube on live podcasts.
When donations are incorporated on a social app it fosters an environment that makes donating acceptable and fun. Hardly anyone is going to trust their debit card/credit card details to a random site, but the masses will trust buying credits/donations/subscriptions through tiktok,youtube, twitch, patreon etc.