Stealth Infra

Stealth Infrastructure — Anti-Bot Evasion & Covert Operations

This skill covers the stealth tooling installed in the sandbox for evading anti-bot systems, rotating proxies, solving CAPTCHAs, and retrieving credentials from password managers. Use these tools when the engagement RoE specifies OPSEC level quiet or silent, or when targets deploy WAFs/anti-bot shields.

Available Libraries (Pre-Installed)

1. Scrapling — Primary Anti-Bot Bypass

Scrapling's StealthyFetcher uses a real Chromium instance with anti-fingerprinting patches. It bypasses Cloudflare Turnstile, Akamai, DataDome, and most JS challenges.

# Stealthy fetch — bypasses Cloudflare Turnstile and most anti-bot
timeout 60 python3 -u -c '
from scrapling.fetchers import StealthyFetcher

page = StealthyFetcher.fetch(
    "https://<TARGET>",
    headless=True,
    network_idle=True,
    disable_resources=True,  # skip images/fonts for speed
)
print(f"Status: {page.status}")
print(f"Title: {page.css(\"title::text\").get()}")
# Extract data
for link in page.css("a[href]"):
    print(f"  {link.attrib[\"href\"]}")
' 2>&1 | tee scrapling_result.txt

With proxy rotation:

timeout 60 python3 -u -c '
from scrapling.fetchers import StealthyFetcher

page = StealthyFetcher.fetch(
    "https://<TARGET>",
    headless=True,
    network_idle=True,
    proxy={"server": "socks5://127.0.0.1:9050"},  # Tor
)
print(page.status, page.css("title::text").get())
'

Session persistence (cookies survive across requests):

timeout 60 python3 -u -c '
from scrapling.fetchers import StealthyFetcher

# First request — login
fetcher = StealthyFetcher()
page = fetcher.fetch("https://<TARGET>/login", headless=True)
# Fill and submit login form...

# Second request — authenticated, same session
page2 = fetcher.fetch("https://<TARGET>/dashboard", headless=True)
print(page2.css("h1::text").get())
'

2. curl_cffi — TLS Fingerprint Impersonation

Real browser TLS fingerprints without running a browser. Fastest option for API probing.

timeout 30 python3 -u -c '
from curl_cffi import requests

# Impersonate Chrome 131
r = requests.get(
    "https://<TARGET>",
    impersonate="chrome131",
    timeout=10,
)
print(f"Status: {r.status_code}")
print(f"Server: {r.headers.get(\"server\", \"?\")} | CF-RAY: {r.headers.get(\"cf-ray\", \"none\")}")
print(r.text[:500])
'

With proxy:

r = requests.get(
    "https://<TARGET>",
    impersonate="chrome131",
    proxies={"https": "socks5://127.0.0.1:9050"},
    timeout=10,
)

Available impersonation profiles:

• chrome99 through chrome131
• firefox109, firefox133
• safari15_3, safari18_0
• edge99, edge101

3. Proxy Infrastructure

Proxychains (route any CLI tool through proxy)

# Start Tor (if not running)
tor &
sleep 5

# Route curl through Tor
proxychains4 curl -s https://check.torproject.org/api/ip

# Route any scanner through Tor
proxychains4 subfinder -d <TARGET> -silent
proxychains4 httpx-pd -l subdomains.txt -silent

Free proxy rotation (Proxifly)

# Download fresh proxy list
curl -sL https://cdn.jsdelivr.net/gh/proxifly/free-proxy-list@main/proxies/protocols/https/data.json -o proxies.json

# Use in Python
timeout 30 python3 -u -c '
import json, random
from curl_cffi import requests

with open("proxies.json") as f:
    proxies = json.load(f)

# Pick a random proxy
proxy = random.choice(proxies)
proxy_url = f"{proxy[\"protocol\"]}://{proxy[\"ip\"]}:{proxy[\"port\"]}"
print(f"Using proxy: {proxy_url} ({proxy.get(\"country\", \"?\")})")

r = requests.get(
    "https://<TARGET>",
    impersonate="chrome131",
    proxies={"https": proxy_url},
    timeout=10,
)
print(f"Status: {r.status_code}")
'

Custom proxy chain (edit /etc/proxychains4.conf)

# For OPSEC-quiet: chain through your VPN + Tor
cat > /tmp/chain.conf << 'EOF'
strict_chain
proxy_dns
[ProxyList]
socks5 <YOUR_VPN_SOCKS_IP> <PORT>
socks5 127.0.0.1 9050
EOF
proxychains4 -f /tmp/chain.conf curl -s https://<TARGET>

4. Credential Retrieval from Password Managers

Python keyring (generic — works with GNOME Keyring, macOS Keychain, KWallet)

timeout 10 python3 -u -c '
import keyring

# Retrieve stored credential
password = keyring.get_password("telenor-vdp", "test-user")
if password:
    print(f"Retrieved password for test-user: {password[:3]}***")
else:
    print("No credential stored. Use: keyring.set_password(\"telenor-vdp\", \"test-user\", \"<password>\")")
'

Store credentials for the engagement:

timeout 10 python3 -u -c '
import keyring
keyring.set_password("telenor-vdp", "test-user", "<PASSWORD>")
print("Credential stored in keyring")
'

1Password CLI (if configured):

# Sign in (requires setup)
eval $(op signin)

# Get a credential
op item get "Telenor VDP" --fields username,password --format=json

Cookie injection from file:

# Load cookies exported from browser (Netscape format or JSON)
timeout 30 python3 -u -c '
import json
from curl_cffi import requests

# Load cookies from JSON file (exported via browser extension)
with open("/workspace/cookies.json") as f:
    cookie_data = json.load(f)

# Build cookie jar
cookies = {}
for c in cookie_data:
    cookies[c["name"]] = c["value"]

r = requests.get(
    "https://<TARGET>/dashboard",
    impersonate="chrome131",
    cookies=cookies,
    timeout=10,
)
print(f"Status: {r.status_code}")
print(r.text[:500])
'

5. CAPTCHA Handling

Cloudflare Turnstile — Scrapling handles this automatically:

# StealthyFetcher automatically solves Turnstile challenges
page = StealthyFetcher.fetch("https://<TARGET>", headless=True, network_idle=True)
# If Turnstile was present, page.status will be 200 (solved) or 403 (failed)

For other CAPTCHAs (reCAPTCHA, hCaptcha):

1. Manual solve: Use Scrapling's StealthyFetcher to render the page, screenshot, solve manually
2. Token injection: If you have a CAPTCHA-solving service API key, inject the token:

timeout 60 python3 -u -c '
from curl_cffi import requests

# After obtaining CAPTCHA token from a solving service:
CAPTCHA_TOKEN = "<solved-token>"

r = requests.post(
    "https://<TARGET>/login",
    impersonate="chrome131",
    data={
        "username": "test",
        "password": "test",
        "g-recaptcha-response": CAPTCHA_TOKEN,
    },
    timeout=10,
)
print(r.status_code, r.headers.get("location", ""))
'

6. Rate Limiting & Traffic Shaping

# Respectful rate-limited scraping
timeout 120 python3 -u -c '
import time, random
from curl_cffi import requests
from fake_useragent import UserAgent

ua = UserAgent()
TARGET = "https://<TARGET>"
PATHS = ["/api/users", "/api/orders", "/api/settings"]

for path in PATHS:
    # Random delay: 2-5 seconds (mimics human)
    time.sleep(random.uniform(2, 5))

    r = requests.get(
        f"{TARGET}{path}",
        impersonate="chrome131",
        headers={"User-Agent": ua.random},
        timeout=10,
    )
    print(f"{r.status_code} {path}: {len(r.text)} bytes")
'

Anti-Patterns (Do NOT)

• Never send requests at machine speed without delays — even 100ms intervals look like a scanner
• Never use default python-requests User-Agent for stealth operations — it's fingerprinted by every WAF
• Never hardcode credentials in scripts — use keyring or env vars
• Never skip the WAF detection step — knowing what you face determines the right bypass
• Never use raw requests.get() against Cloudflare — it will always fail; use curl_cffi or scrapling
• Never brute-force CAPTCHAs — solve or bypass them; repeated failures trigger IP bans

Decision Tree

Target has anti-bot? → Yes → Which type?
  ├─ Cloudflare Turnstile → StealthyFetcher (automatic)
  ├─ Cloudflare JS Challenge → cloudscraper or StealthyFetcher
  ├─ Akamai/DataDome → StealthyFetcher with proxy rotation
  ├─ reCAPTCHA/hCaptcha → Manual solve or token injection
  └─ Custom WAF → curl_cffi with browser TLS fingerprint

Target has rate limiting? → Yes
  ├─ Soft (429 after N requests) → Add 2-5s random delays
  └─ Hard (IP ban) → Rotate proxies via proxychains4 or Proxifly

OPSEC level quiet/silent?
  ├─ Use Tor for DNS + requests (proxychains4)
  ├─ Rotate User-Agents (fake-useragent)
  └─ Never reuse the same proxy for >10 requests