Possible Feature Discussion

[rhayes2]

Detecting Spoofed Browsers / Crawlers or Bots by following chart on how browsers respond to specific status when loading specific content type.

I would be happy to help if interested or provide some more context 👍 . I saw the Status codes and got excited, also a chance for me to look at some GO.

About Me: Old Seneca Student that really wants his 7th Year Hacktoberfest shirt as well and Invites anyone to PR my Repos.

[tonyvugithub]

hey Ryan! your willing is very welcome! At the moment, I don't have a file type specific responding status code so your notice could be ground breaking here. Can you discuss a little bit more what you are thinking to improve this API in this aspect?

[rhayes2]

Yes, I was thinking you could have a route that could serve a simple webpage.

This webpage could run through a few tests, lets say loading a JavaScript file or html but sending different response codes when it does it.

However the response codes that we would choose would be based on each browser known response (the browser's api: Images above) to determine what browser is being used. an example would be

Firefox cannot load JavaScript on very many response codes but Chrome on the other hand CAN. So maybe we can compare this to what browser is reflected in the "User-Agent" string. Then Try and send JavaScript with a Status code that shouldn't work to that browser and see what it does.

This could be a browser fingerprinting without relying on user-agent strings or to determine if something weird is happening.

What are your thoughts?

There was a small Defcon talk about this sort of thing from many years ago, I can provide the link if interested

[tonyvugithub]

This sounds great. Lets me break it down to multiple steps so we can try to answer each.

1. Find out how server can receive browser information for each request?
   => We already know we can manipulate the route using param so we don't have to reply on user-agent field in the header. Even if the browser used is chrome, you can still get back the response in Firefox. If we use tool like Postman to do the test then we can manipulate User-Agent

2. Add a query param to ask for which file type to be returned?
   => This is straightforward

3. Send back different file types rather than html?
   => At the moment, I have limited knowledge in this. Maybe you can add to it.

Am I missing something here that you have mentioned?

In my opinion, This is doable and we should do it. Please send me the link to the Defcon talk as well. And thank you for putting thoughts into it, so we can have a better API. Can you also send me the link to of the images you have shared? I have tried searching for browser API but no luck

[tonyvugithub]

@rhayes2 : Just want to bump it up, in case it got pushed down by other emails. Are you still interested to contribute? Please let me know. Thanks.

[rhayes2]

Yup, Just been more busy then I expected. I just finished a large project however the client wants a bunch changes so I've been tied up. Hopefully there wont be many more things.
¯\(ツ)/¯

I'll answer your questions tonight, after work, maybe it would be nice if we had a discord collab group

[tonyvugithub]

@rhayes2 no worry at all. There is no rush. I just want to check in with you as I believe your idea is a great add-on. I created a discord server for communication convenience. Here the invite: https://discord.gg/HvjK2FW