Research
Method and architecture notes on client-side detection systems. Safe targets and public concepts only — no bypasses, generators, or live attack material.
For years, a quiet advantage propped up bot detection: bots were brittle. Change the flow and their hardcoded logic shattered until a human rebuilt them. AI agents remove that brittleness — they adapt in real time, and anyone can deploy one. That's the real shift.
"Limit one per customer" is easy to say and hard to enforce, because online, one customer can look like fifty. A look at how fake accounts and spoofed addresses defeat purchase limits, and how address validation and payment checks quietly shut it down.
What Ghidra is, why the NSA built it and gave it away, why it's indispensable to defenders — and why the same capability demands judgment about how it's used.
Before a browser sends a single byte of HTTP, its TLS handshake has already announced what software is really making the connection. Here's how ClientHello fingerprinting works, why it's tied to specific Chrome versions, and why a mismatched User-Agent is one of the cleanest tells in bot detection.
Proxies are how one actor becomes a thousand. A tour of datacenter, residential, and mobile proxies, why the residential kind defeats IP-based defense by design, and the uncomfortable supply chain that produces them — often from the phones of people who have no idea.
The strongest form of JavaScript obfuscation doesn't scramble your code — it invents a whole fake computer to run it on. Here's what a JS VM is, why anti-bot and DRM vendors rely on it, and what it can and can't actually protect.
CAPTCHAs increasingly fail against the automation they're meant to block, while taxing the humans they're meant to protect. A look at why, and what actually raises the cost of abuse.
The client-side script on a protected site quietly takes a reading of your device and behavior, bundles it, and ships it off to be scored. Here's what's actually in that reading — and why the most powerful signals are also the most invasive.
Frida turns a running app inside-out at runtime — reading memory, hooking functions, bypassing client-side checks. Here's what it is, why obfuscation doesn't stop it, and why Frida, root, and jailbreak detection are a treadmill you can never step off.
Virtual waiting rooms are supposed to give real customers a fair shot at limited stock. But when a queue orders people by who joined first, it just re-runs the exact speed race bots always win. The fix is in the ordering.
No writeups with that tag.
