Hackbrowser blocked by Cloudflare — no stealth, uses Playwright Chromium

[badchars]

Summary

Hackbrowser was blocked by Cloudflare bot detection (Turnstile) because it had zero anti-detection measures and used Playwright's bundled Chromium which has a distinct TLS fingerprint (JA3/JA4).

Problems

1. No stealth at all — no navigator.webdriver override, no launch args, hardcoded Chrome/120 UA
2. Multi-cred path inconsistent — single-cred had partial inline stealth, multi-cred had none
3. Playwright Chromium TLS fingerprint — network-level detection that JS patches can't fix
4. --disable-gpu flag — signals headless mode to CF
5. No WebGL/Canvas fingerprint protection
6. Hardcoded UA doesn't match actual browser version

Fix (6 commits)

Stealth module (packages/hackbrowser/src/stealth.ts)

• 2937d4e — Created centralized stealth module (launch args, dynamic UA, init script)
• e429fe3 — Enhanced with WebGL/Canvas fingerprint, screen/timezone/locale, navigator.connection

Agent integration

• 9eb998a — Both launch paths (single-cred + multi-cred) use Stealth module

System Chrome detection (bypasses TLS fingerprinting)

• bb7df03 — CDP support via --use-chrome flag
• 107745d — Attempted channel:'chrome' (failed — Playwright registry breaks under Bun --compile)
• 6966d52 — executablePath with direct path detection (macOS/Windows/Linux). Auto-detects system Chrome, falls back to Playwright Chromium if not installed.

Stealth init script covers

• navigator.webdriver = false
• Chrome DevTools Protocol marker cleanup (cdc_*)
• Realistic navigator.plugins (3 entries vs empty)
• navigator.languages, hardwareConcurrency, deviceMemory, maxTouchPoints
• navigator.connection stub (4g/50ms)
• Screen dimensions (1920x1080 consistent)
• WebGL vendor/renderer spoofing (Intel Iris)
• Canvas fingerprint noise (toDataURL pixel mutation)
• Permissions.query notification fix
• chrome.runtime stub

Browser selection priority

1. System Chrome via executablePath (real TLS fingerprint)
2. Playwright Chromium fallback (if no Chrome installed)
3. CDP connection via --use-chrome <url> (connect to already-running Chrome)

Note

Cloudflare Turnstile with advanced TLS fingerprinting may still block even system Chrome under Playwright automation. For those cases, IP whitelisting in the pentest scope is the standard practice.

[badchars]

Fixed in 6 commits: 2937d4e, 9eb998a, e429fe3, bb7df03, 107745d, 6966d52