Hey guys, Though i would share some knowledge with regards to how various football/soccer websites are protecting from checkout bots.
I will in time make this thread more robust, However for now i will be outlining the basics.
What is datadome?
DataDome is a leading bot management and online fraud protection solution. It is designed to safeguard websites, mobile apps, and APIs from automated threats such as bots, scrapers, and fraud attempts. Using advanced machine learning and behavioral analysis, DataDome identifies and mitigates harmful bot activities in real-time without impacting legitimate user traffic.
In short it uses various methods to validate human traffic and block bot related requests.
How does it work?
Currently datadome uses 2 protective measures on ticketing websites, The first is the interstitial check.
When you make your first request to a website you will in every case be blocked, In the 403 response you will be given information like this:
data-cfasync="false">var dd={'rt':'i','cid':'AHrlqAAAAAMAkeC0q-UmmV8AUiehwA==','hsh':'13C44BAB4C9D728BBD66E2A9F0233C','b':1501854,'s':48047,'host':'geo.captcha-delivery.com','cookie':'2v~9XD8sWtzAVQfN01CkO_KgwJaS9wD6s9AsE10M_WtzqsWN6k14LO4flvIs9RDtAtoMA4UkLNMdn0eMoyVtuRFTZyphpTNlT5FYByJG_8OKS89EwzpFK4poUdUr2r_Y'}
The information from this is then used to craft the challenge url, If there is no heuristic issues or red flags this will be a silent redirect and a silent solve of the challenge. If Datadome detects a potential issue you will then be forced to solve the "Slider" challenge. The challenge url looks like this:
https://geo.captcha-delivery.com/interst...1854&dm=cd
There are various methods of solving this using de-obfuscators and manually entering the signal data to generate a valid cookie, Then once a valid cookie is obtained making the same initial request to the website will then (In seatgeek based websites) lead to a 302 response.
This will then forward you to the Queue-it soft block page, This will force you to solve an invisible captcha, Perform a proof of work and then navigate the soft queue whilst exchanging cookies between several requests until you are once again redirected back to the initial page, This time with a queue-it cookie and a valid datadome cookie, Then you can follow the normal flow to the ticketing page and as long as you follow the same flow a human would take, Exchanging the cookies as they are meant to be exchanged you will not trigger datadome protection.
I will modify this thread going forward with examples in python how to handle certain challenges in the future.
I will in time make this thread more robust, However for now i will be outlining the basics.
What is datadome?
DataDome is a leading bot management and online fraud protection solution. It is designed to safeguard websites, mobile apps, and APIs from automated threats such as bots, scrapers, and fraud attempts. Using advanced machine learning and behavioral analysis, DataDome identifies and mitigates harmful bot activities in real-time without impacting legitimate user traffic.
In short it uses various methods to validate human traffic and block bot related requests.
How does it work?
Currently datadome uses 2 protective measures on ticketing websites, The first is the interstitial check.
When you make your first request to a website you will in every case be blocked, In the 403 response you will be given information like this:
data-cfasync="false">var dd={'rt':'i','cid':'AHrlqAAAAAMAkeC0q-UmmV8AUiehwA==','hsh':'13C44BAB4C9D728BBD66E2A9F0233C','b':1501854,'s':48047,'host':'geo.captcha-delivery.com','cookie':'2v~9XD8sWtzAVQfN01CkO_KgwJaS9wD6s9AsE10M_WtzqsWN6k14LO4flvIs9RDtAtoMA4UkLNMdn0eMoyVtuRFTZyphpTNlT5FYByJG_8OKS89EwzpFK4poUdUr2r_Y'}
The information from this is then used to craft the challenge url, If there is no heuristic issues or red flags this will be a silent redirect and a silent solve of the challenge. If Datadome detects a potential issue you will then be forced to solve the "Slider" challenge. The challenge url looks like this:
https://geo.captcha-delivery.com/interst...1854&dm=cd
There are various methods of solving this using de-obfuscators and manually entering the signal data to generate a valid cookie, Then once a valid cookie is obtained making the same initial request to the website will then (In seatgeek based websites) lead to a 302 response.
This will then forward you to the Queue-it soft block page, This will force you to solve an invisible captcha, Perform a proof of work and then navigate the soft queue whilst exchanging cookies between several requests until you are once again redirected back to the initial page, This time with a queue-it cookie and a valid datadome cookie, Then you can follow the normal flow to the ticketing page and as long as you follow the same flow a human would take, Exchanging the cookies as they are meant to be exchanged you will not trigger datadome protection.
I will modify this thread going forward with examples in python how to handle certain challenges in the future.
https://hackforums.net/member.php?action...uid=577996 RIP @Royal !@ Didn't think you'd get caught out, Imagine being my imposter <3
