Mutt
Professional
- Messages
- 1,097
- Reaction score
- 717
- Points
- 113
Manual: Setting up real configs from scratch. Working with logs: Tips and tricks when working with logs and using antidetect.
Getting basic information from the system log. In the log, the most basic information about the system is contained in the System.txt file, or Information.log. Screenshot: https://prnt.sc/lx4rp1 In the screenshot I have highlighted the parameters that we need to configure the system.
1. Windows - This parameter contains information about the version of Windows and the bitness of the system (32-bit or 64-bit, 64-bit is much more common). Most often you will see the logs of Windows 7, Windows 10, less often - Windows8, 8.1, XP. We will need this parameter to configure "navigator.UserAgent" and some derivatives.
2. DisplayResolution- This parameter contains information about the user's screen resolution. Required to configure all settings related to screen resolution and browser window size and derived settings.
3. DisplayLanguage, KeyboardLanguages - These parameters contain information about the system language / languages. Needed to configure the parameters "navigator.Language", "navigator.Languages" and HTTP_ACCEPT_LANGUAGE.
4. CPUCount - This parameter contains information about the number of processor threads. Needed to configure the parameter "navigator.hardwareConcurrency"
5. RAM - This parameter contains information about the amount of RAM. Required for setting "navigator.deviceMemory"
6. Videocard- This parameter contains information about the system video card. Required for configuring WebGL. Please note that the system can contain two video cards: one discrete and the other integrated. This is usually used on laptops. And which of them runs for the browser is 100% unknown. Firstly, the user can manually set what kind of video card will be used, and secondly, for example, it can be like this: if the laptop is on charge, a discrete video card is used, but if it is powered by a battery, then it is an integrated one. Therefore, in laptops, you should not rely on this parameter 100%.
7. [Network]We take almost all parameters, except Geo (Latitude and Longitude); This information will be useful to you for a more competent selection of Socks / SSH-tunnel. There is no ZIP in my log, but it is not difficult to break through it. To do this, you just need to punch the IP address through the MaxMind database, or find the user's home address in the browser autocomplete, or in the mail or in the shop. It is advisable to select the IP not only as close as possible to the ZIP address, but also, if possible, with the same IP mask and the same Internet provider.
Our next step will be to determine the type of browser and browsers to create the configuration. It happens that PC owners use multiple browsers, not just one. Therefore, if necessary, it is better to create two sessions in the sphere, i.e. two configurations, rather than loading cookies into one. To do this, we look at the sites we need with logins and passwords in the file "passwords.txt" parameter "Soft" Screenshot: https://prnt.sc/lx5ofi , as well as files in the "Cookies" folder for the presence of the necessary sites (files in this folder divided into browsers; it is possible that the Cookies files can be stored in a shared folder. It all depends on which style is logged with). Example: http://prntscr.com/lx5oag
In my case, there is only one GoogleChrome browser in the log, so I mark myself only 1 browser. Moving on to more interesting information that does not lie on the surface.
Determine if there is FLASH in the system and its version, determine the browser version (if possible)
To do this, go to the System.txt file, or Information.log and look for "Adobe Flash Player" in the [Software] section of the installed programs. If found, we mark that there is Flash, write down its version. There are two types of AdobeFlashPlayer: AdobeFlashPlayer ** NPAPI - Firefox subbrowser. AdobeFlashPlayer ** PPAPI-sub-browser Opera / Chrome.Screenshot: http://prntscr.com/lx5ztv
Next, on the same screenshot, we see the version of GoogleChrome, if not, then we try to find it in the file by the query "GoogleChrome". We also mark the version for ourselves. We will need the type of browser and its version to configure the "navigator.UserAgent" parameter, and, in exceptional cases, to disable Canvas substitution. Browser MozillaFirefox search for "Firefox", we should find something like this "MozillaFirefox64.0 (x64 en-US) [64.0]". The name of the Firefox browser contains the bitness of the program (32 or 64bit), which is also useful in setting "navigator.UserAgent". Opera browser search for "Opera", we should find something like this "OperaStable57.0.3098.106 [57.0.3098.106]"
For various reasons, it is not always possible to determine the version of the browser, one of which - the browser may be Portable, i.e. not installed on the system. IE browser will not be visible, because it is already natively in Windows, with Edge in Win10 the same hat.
We need Flash and its version in order to add it to plugins and, if necessary, enable its physical version in the antidetect.
Determine the user's desktop or laptop.
You can determine this using various options.
1. According to the screenshot of the screen in the log. On the screenshot of the screen, we are looking for something that is characteristic of a laptop on the taskbar in the lower right corner, or on the desktop for something that is characteristic of a laptop (software icons for a laptop, etc.)
On the taskbar, you can find Battery icon, Wi-Fi connection icon. Now I will show this with examples.
Examples:
http://prntscr.com/lx86z7
https://prnt.sc/lx871y
2. By information about the processor in the system. To do this, go to the System.txt or Information.log file and look at the Processors parameter Screenshot: https://prnt.sc/lx88az
Copy the value and google information about the processor. Here is an example of information on this processor from the Intel website, which shows us that the user has a desktop computer. Screenshot: https://prnt.sc/lx89jp
An example of information about a processor for a laptop. Screenshot: http://prntscr.com/lx8g8y
Well, another option is to search in processes or installed programs in the System.txt file, or Information.log for processes / programs that belong to the laptop. For example, these are processes in which the keyword "Bluetooth" appears, programs specific to a particular laptop manufacturer (ASUS, DELL, MSI, ACER, etc.).
Examples of processes: "Intel (R) Wireless Bluetooth (R)", "Dell Touchpad" ...
It is necessary to know several options, because sometimes the screenshot may not be there, or the screenshot is obtained in a certain area without the taskbar, sometimes the taskbar is hidden.
Taskbar: determine the position of the taskbar on the screen, the size of the icons and whether the taskbar is hidden (if possible)
The first question that comes to mind: "Why the heck do you need it?" The answer is: this is necessary in order to set the screen size; the size of the browser window and the size of the working area of the browser in full-screen mode of the browser (parameters "window.innerWidth", "window.innerHeight", "window.outerHeight", "window.outerWidth").
Of course, not every log will have such an opportunity to look at and understand 100% of everything. Sometimes a screenshot may not be available, there may be a screenshot of an incomplete screen area
Now I will show you how to correctly evaluate these parameters . Screenshot : https://prnt.sc/lxy3x0
These examples are made on OCWindows7. If you wish, you yourself can then look and play with these settings on any OCWindows
1) Position of the taskbar. Happens: horizontal and vertical. For most users, the default position is horizontal.
2) The size of the taskbar icons. There are two sizes of icons: large and small. By default, the size of the icons is large. Most users have large icons. On Windows7 there is a peculiarity: if the icons are small, then the icon of the "start" button protrudes beyond the taskbar area. Sometimes it is not always possible to understand the size of the icons even from the screenshot, I advise you to also pay attention to DisplayResolution in the log; One thing is a screenshot of the screen size "1024 x 768", another thing is "2560 x 1440"
3) Hidden taskbar. By default, the taskbar is not hidden for most users. A hidden taskbar doesn't mean it's not there at all. It just does not appear on the screen, but appears when you hover the mouse cursor. If you have a full screenshot of the screen in your log and there is no taskbar there, then it is just hidden.
4) If in the screenshot the owner of the PC has the type of browser you need open, mark this as well, it will be useful in setting up. Screenshots with an open browser are quite common.
User's network: we define an approximate router and its model (if possible)
Sometimes, from the log, you can determine the brand of the user's router or its approximate model. It may be necessary for more precise configuration of WebRTC, or rather, LocalIPAddress.
To do this, you need to look in the log in the file with logins / passwords or in the file where the browser history is stored, the popular IP address masks of routers. Here is a link to the table of brands of the most popular routers and default local ip addresses:
https://docs.google.com/spreadsheets/d/1GySRwS_QAmvPSJEDxYcsGnz_7Vu_mtj0nn_RvY4wgl4/edit?usp=sharing
The most popular masks for searching in the log. "," 10.1. "," 10.90. ". I highlighted the most popular brands in light blue in the table.
If there will still be a login and a password, you can try here to look at the brands of the standard login / password bundles by brands:
https://192-168-1-1ip.mobi/default-router-passwords-list/
For example https://prnt.sc/ly3sww[/URL] assume that the PC user has a D-Link router. But this is not 100%, since several more routers have the same bundle.
The browser history file can sometimes show us much more accurate information. Here's an example: https://prnt.sc/ly41tw
In the browser history, we see LocalIPAddress plus the page title, which gives us a huge plus in defining the router.
If you google "B593s-931", then you can determine that this is the name of the router "HUAWEI B593s-931". Another example: https://prnt.sc/ly49nx If you google "userRpm / DdnsAddRpm.htm", you can see that the router belongs to TP-LinkTL-WR741N / ND, or TL-WR841N, or some others.
In addition to LocalIPAddressWebRTC, the information will be useful if someone changes the MAC address, since the "beginning" of the MAC address is different for each manufacturer.
Browser plugins: identify popular plugins that are installed in the browser.
Plugins in any program are add-ons that allow you to expand its capabilities. Most of the popular browsers have the ability to install plugins that extend its capabilities. For example, it can be a Flash plugin from Adobe, the ability to read PDF pages in a browser; in Chrome, this plugin is already included by default; the ability to run any Audio / Video codecs.
With each new release of updates, the number of new features and variations of the supported content increases, so plugins are gradually losing their relevance. As a result, in the browsers Chrome, Firefox, Opera, Edge, there are only built-in plugins and one added: AdobeFlashPlayer. Therefore, the search for plugins is more relevant for the InternetExplorer browser, or for older versions of Firefox (up to version 52), Chrome, Opera.
Most popular plugins: Flash, Java, MicrosoftOffice, Adobe PDF Reader, Windows Media Player, Real Video / Audio.
At the beginning of the article, we already determined whether Flash is on the system. So FlashPlayer is also a browser plugin. Therefore, if there is Flash, then in some types of browser it will be in plugins. We mark ourselves, if available.
We will also look for other plugins in the System.txt file, or Information.log in the [Software] section of the installed programs.
Plugin QuickTimenahodim on request «QuickTime», estimated plugin name: «QuickTime7 [7.79.80.95]»
plugin Silverlightnahodim on request «MicrosoftSilverlight», estimated plugin name: «MicrosoftSilverlight [5.1.50907.0]»
plugin Javanahodim on request «Java», approximate name plug-in: "Java8 Update191 [8.0.1910.12]"
RealPlayer plug-in found by request "RealPlayer", the approximate name of the plug-in: "RealPlayer [18.1.15.]"
Plugin AdobeAcrobat (for reading PDF files) we find the query "AdobeAcrobatReader 19.0.0 .20064.] "
There are many other different plugins, this was just an example of popular plugins. The list can be continued for a very long time.
This completes the collection of information from the log. As a result, we have collected the following information: Windows: Windows 10 Home [x64] Display Resolution: 1920x1080
Windows: Windows 10 Home [x64]
Display Resolution: 1920x1080
Display Language: en-US
Keyboard Languages: English (United States)
CPU Count: 4
RAM: 8139 MB
VideoCard: NVIDIA GeForce GTX 970
[Network]
IP: 38.104.174.234
Country: United States (US)
City: Pleasant View (California)
ZIP: 93260
ISP: Cogent Communications (Txox Communications)
-
Browser: Google Chrome ver. 68.0.3440.106
Flash: available, ver. 30.0.0.154
-
PC: Laptop
-
[Taskbar]
Position: Horizontal
Icon size: Large
Hidden taskbar: No
Is there a browser in the screenshot: YES
-
Router: ~ TP-Link TL-WR741N or TL-WR841N
-
[Browser Plugins]
Adobe Flash
PlayerReal
PlayerAdobe
Acrobat
Of course this example has too much information. In practice, it may be less.
Manual for setting up real configs from scratch using antidetect.
Let's move on to the most interesting section of this article.
The basis of all the basics - UserAgent
UserAgent is the basis for creating a config. As building a house begins with a foundation, so creating a config starts with UserAgent (abbreviated as UA). Let's start with theory. Let's figure out what UA is.
UserAgent is a property (parameter) that contains properties used to determine which browser, which operating system, which version, and what specific software the user has.
In the configs of any Antidetect, this parameter is located in navigator.UserAgent and in HTTP_USER_AGENT.
Note : navigator.UserAgent and HTTP_USER_AGENT are always the same, but there is an exception: InternetExplorer browsers. Very often in these browsers, navigator.UserAgent contains information about the user's software.
Example:
HTTP_USER_AGENT: "Mozilla / 5.0 (Windows NT 6.3; WOW64; Trident / 7.0; rv: 11.0) like Gecko"
navigator UserAgent : "Mozilla / 5.0 (Windows NT 6.1; WOW64; Trident / 7.0; SLCC2; .NET CLR 2.0 .50727; .NET CLR 3.5.30729; Media Center PC 6.0; rv: 11.0) like Gecko »
Let's take a look at how to compose the UA of the most popular browsers in Windows. Let's start with the simplest - MozillaFirefox. UserAgent structure:
Mozilla / 5.0 (< Windows version >; <bit tags>; rv: <Firefox version>) Gecko / 20100101 Firefox / <Firefox version>
Above, I have highlighted the parameters that you need to know for creating a real UA.
< Windowsversion > - Operating system version. The options are:
Windows NT 6.0 – Windows Vista, Windows Server 2008.
Windows NT 6.1 – Windows 7, Windows Server 2008 R2.
Windows NT 6.2 – Windows 8, Windows Server 2012.
Windows NT 6.3 – Windows 8.1, Windows Server 2012 R2.
Windows NT 10 – Windows 10, Windows Server 2016 & 2019.
This parameter is available in all UAs on Windows. Note: on Edge browsers it is static, i.e. does not change, because the browser is sharpened just for Windows 10.
< bittags > - "bitness" of the system. I think everyone knows and everyone has met with the fact that there are two 32-bit Windows systems and 64-bit ones. It is the browser that transmits the possible variations:
Win64; x64 - this value is transmitted if the system is 64-bit.
Empty value (nothing is passed)if the system is 32-bit. Example UA: Mozilla / 5.0 (Windows NT 6.1; rv: 60.0) Gecko / 20100101 Firefox / 60.0
WOW64 - this value is transmitted when a 32-bit browser application is running on a 64-bit system.
<Firefoxversion> - this value shows the version of your Firefox browser. Note: the value is transmitted with only one digit after the dot, even if the browser version is "63.0.3", then only "63.0" will be transmitted to UA. Here is a link for a list of all current Firefox versions: https://www.mozilla.org/en-US/firefox/releases/
By combining these values, we get different UserAgent's. Do not forget that the values "rv:" and "Firefox /" are required must match.
Examples: Mozilla / 5.0 (Windows NT 10.0; Win64; x64; rv: 64.0) Gecko / 20100101 Firefox / 64.0 –UserAgent Windows 10 [64bit] with browser Firefox 64.
Mozilla / 5.0 (WindowsNT6.1; rv: 52.0) Gecko / 20100101 Firefox / 52.0 0 –UserAgentWindows7 [32 bit] with browser Firefox version 52.0.1 or 52.0.2
Mozilla / 5.0 (WindowsNT6.1; WOW64; rv: 43.0) Gecko / 20100101 Firefox / 43.0 –UserAgentWindows7 [64 bit] with browser Firefox, which is calculated as a 32-bit system version 43.0.1, or 43.0.2, or 43.0.3, or 43.0.4
Go to the Google Chrome browser.
UserAgent Google Chrome framework:
Mozilla / 5.0 (<Windows version>; <bit tags>) AppleWebKit / 537.36 (KHTML, like Gecko) Chrome / <Chromeversion> Safari / 537.36
Despite the fact that UAChrome seems to be more complicated, in fact it is even a little simpler. Chrome versions do not need to be duplicated twice.
<Windowsversion> and <bittags> are exactly the same values as in Firefox.
<Chromeversion> - this value shows the version of your Chrome browser. Here is a link for a list of current versions of Chrome: https://filehippo.com/download_google_chrome/history/
Example : Chrome / 71.0.3578.98
71.0.3578 is the browser version.
98 - Build. It shows how many fixes of various bugs, improvements were in this version.
Examples:
Mozilla/5.0 (WindowsNT6.3; Win64; x64) AppleWebKit/537.36 (KHTML, likeGecko) Chrome/71.0.3578.98 Safari/537.36–UserAgentWindows8.1 [64 bit] с браузеромGoogleChrome версии 71.0.3578 с build98.
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.110 Safari/537.36–UserAgentWindows 10[64 bit] сбраузеромGoogle Chrome версии70.0.3538сbuild 110.
Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.110 Safari/537.36 36–UserAgentWindows 10[32bit] сбраузеромGoogle Chrome версии70.0.3538сbuild 110.
Переходим к Opera.
Mozilla/5.0 (<Windows version>;<bit tags>) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/<Chromeversion>Safari/537.36 OPR/<Operaversion>
The Opera browser is implemented on the WebKit engine and V8 in the Chromium shell, so there is “Chrome / <Chromeversion>” in the UA, we can say that UserAgent is not very different.
<Windowsversion> and <bittags> and <Chromeversion> are absolutely all the same as I described above. The only moment with chrome versions, but more on that below.
<Operaversion> - this value shows the version of your Opera browser. Here is a link to the list of current versions of Opera: https://blogs.opera.com/desktop/
We are interested mostly in "Stable update", "beta update, developer update, initial release" -in to a lesser extent.
Example: OPR / 56.0.3051.116
56.0 – browser version
3051 – Build browser
116 – Patch browser.
I will clarify what is the peculiarity of Chrome. A specific version of Opera has a specific version of Chrome. You can't write a version of Chrome from the bulldozer, or vice versa. These two values must be consistent.
Here is a table, I threw in 11 versions of the Opera browser as examples.
https://docs.google.com/spreadsheets/d/1OglvdCpkWxr0GztpQ3Nzi3Ij0Ep4oEZxdfZn-PVwdqU/edit?usp=sharing
Examples:
Mozilla / 5.0 (WindowsNT10.0; Win64; x64o, Apple.3Web6GeHT5.0ck) Safari / 537.36 OPR / 55.0.2994.44 -UserAgentWindows10 [64 bit] with Operator version 55.0
Mozilla / 5.0 (Windows NT 6.2; WOW64) AppleWebKit / 537.36 (KHTML, like Gecko) Chrome / 68.0.3440.106 Safari / 537.36 OPR.4 / 55.0.2 UserAgentWindows 8 [64bit] with Opera32-Bit version 55.0
We turn to the Edge browser.
UserAgentEdge structure:
Mozilla / 5.0 (Windows NT 10.0; <bit tags>) AppleWebKit / 537.36 (KHTML, like Gecko) Chrome / <Chromeversion> Safari / 537.36 Edge / <Edgeversion>
<bittags> and <Chromeversion> are exactly the same as me wrote above
< Edgeversion > - this value shows the version of your Edge browser. Just like Opera, a certain version of Edge has a certain version of Chrome.
Here is a link to the current Edge versions: https://en.wikipedia.org/wiki/Microsoft_Edge
Note: We need the values "EdgeHTML version" and not "Version"
Example: Edge / 17.17134
17 - EdgeHTML Version
17134 - Window Build.
Table with examples of EdgeChrome versions
https://docs.google.com/spreadsheets/d/1QkUj5f0oPIUGU6aGyZSS9DNUpGCaywv9W50y-tvSVPM/edit?usp=sharing
Examples:
Mozilla / 5.0 (WindowsNT10.0; Win64; x64) AppleWebKit / 537.36 (likeG40.1 Safari / 537.36 Edge / 17.17134 -UserAgentWindows10 [64 bit] with Edge browser version 17.
Mozilla / 5.0 (Windows NT 10.0) AppleWebKit / 537.36 (KHTML, like Gecko) Chrome / 64.0.3282.140Safari / 537.36 Edge / 17.17134-UserAgentWindows 10 [32 bit] with Edge browser 17.
To conclude on this topic UA, there is still a lot to say about existing UAs, since I have analyzed only the most basic browsers and the most popular and simple options. If at all this article goes, then I will reveal in more detail about more complex variations of UserAgent from different types of browser; about mobile UserAgent new types of browsers.
Other options where you can get UA:
1) Real devices.
2) https://developers.whatismybrowser.com/useragents/explore/ Many different UAs by browser type, by OC, mobile UA, etc. There are a lot of sampling options. The disadvantages are that there is a lot of any "slag", there are not so many newer versions; there is a parameter of UA popularity, but I would not advise you to focus on it.
3) Configshop. Actually, in the config shops, you can safely see this parameter without buying a config. The option is very convenient, because you can make a selection according to the necessary parameters and the most relevant UAs in the config shops. In some, you can simply register easily. I will not throw links here, who will really need it - write in the LAN or by contact.
Let's go through the simple config settings in LinkenSphere (Extendedsessionsettings).
Navigator.vendor - This parameter displays the name of the browser vendor. In our browser types, the Value is empty, or "Google Inc." The parameter is static, i.e. does not change. Values in our browser types:
Firefox - empty
Edge - empty
Chrome - GoogleInc.
Opera - Google Inc. [/ QUOTE]
Navigator.ProductSub - This parameter shows the Build browser number. The parameter is static, i.e. does not change. Values in our browser types:
Firefox - 20100101
Edge - 20030107
Chrome - 20030107
Opera - 20030107
Navigator.hardwareConcurrency- this parameter shows the number of processor threads, and not the number of physical processor cores, as many believe. The parameter does not depend on the type of browsers we are considering. Popular values for this parameter: "2", "4", "8", "12".
For a better understanding, I will consider a new processor on laptops: IntelCorei7-8750H. This is a 6-core processor, but it has 12 threads, therefore the parameter will be set to "12" and not "6". Sometimes the number of threads matches the number of cores. By the name of the processor, you can always look at these values on the Internet. As for the information in the logs, there is just information about the number of threads, so you can safely set this parameter, but just in case, double-check (parameters: # of Cores and # of Threads)
Navigator.MaxTouchPoints- this parameter shows the maximum number of simultaneous touch presses that the device supports, i.e. if the device has several touch screens with different maximum values, the maximum value is shown. The parameter does not depend on the type of browsers we are considering. In general, they usually say that this parameter is more relevant for mobile configs and this is true, but not quite.
An ordinary stationary computer or laptop with a connected mouse and keyboard will show the value "0". Most often, this is the value of the parameter.
But there are touch monitors in laptops, touch monitors for stationary PCs. Therefore, in this case, the parameter value is usually "1" or "2". Therefore, when setting up our types of config, it is permissible to set these values.
According to the information from the log, it is not possible to determine in 95% which particular laptop or which display, so it is better to set the default value "0".
Navigator.Platform - this parameter shows the platform on which the browser is running. Within our browser types and OS, there can be two values: "Win32" and "Win64". But even if Windows64-bit and the browser software are 64bit, the value "Win32" is still used. Therefore, we set only this value.
Navigator.doNotTrack - this technology allows you to enable or disable the ban on tracking by sites, various systems. The most popular values used are: "Null" - the user did not set this parameter, therefore, it is not enabled. This is the most commonly used parameter. "1", "true" - the user has enabled this function, "0",
"False" - the user has disabled this function. All three values can be used in configs, preferably "null" or "0".
Regarding substitution without antidetects, Google has pictures with instructions for each type of browser how to enable / disable this technology
Navigator.gamepads - this technology shows the connected gamepads and their properties (joysticks like on Xbox and Playstation). By values in the sphere: "True" - the function is enabled, "False" - the function is disabled.
Feature: Even if there are no gamepads connected to the system, this function is enabled. So basically we use the T "rue" value for our browser types regardless of the OC version. Even on most mobile browsers, the Navigator function is also
enabled.battery- this technology shows information about the state of the battery (whether charging is in progress, the level of charging in%, the amount of time to fully charge / discharge, etc.). According to the values in LinkenSphere: "True" - this function is used without substitution, "False", "Fake" - is identical to True, only the parameters of the battery itself are substituted.
By use: in Edge, Firefox (after version 52) set only "False", in Chrome and Opera set either "true" or "fake".
This feature, as one might think, applies not only to laptops. On desktop computers, the Battery function is enabled. The difference is that the parameters will be static, as if it were a laptop on a charge at 100%
Information on how to configure this parameter from the log: if you have determined that the PC user can enable "fake" from a laptop, but if your system, where LinkenSphere is installed, has static Battery parameters and the log user has a stationary computer, then it makes sense to enable "True".
On real systems, if you have a laptop, it is very easy to change this parameter, you just need to discharge / charge the battery. Then the values of this function will change.
Navigator.webdriver.Webdriverin a browser, it is a software library (driver) that allows other programs to interact with the browser; manage your browser. This technology appeared in the browser not so long ago, therefore it is experimental, there is not much information on it already. The webdriver technology is supported by all major types of the latest browsers. The main values of the Webdriver property are "true", "false", and "undefined" (undefined). On use in LinkenSphere: if we make configs of older versions of the browser (below 63 Chrome and 50Opera, then use the value "undefined"). In other cases, the values "true" and "false" are allowed. But taking into account the specifics of this technology and how it is implemented in browsers, I advise you to use "false" in 95% of cases.
Navigator.Online- this parameter shows the status of the browser. Parameter options: "True", "False", "1", "0". Here and a no brainer that the value should be "True" or "1". In the sphere, the ability to set only these parameters has been specially established.
Navigator.deviceMemory - This parameter shows the amount of RAM in GB. Values: 0.25 to 256 MB of RAM, 0.5 to 512 MB, 1 to 1024 MB, etc. to a value of 8. If the RAM is more than 8 GB (12 GB, 16 GB, 32 GB, 64 GB), then the value will still be "8". If you configure the Firefox browser config, then set the value "False", i.e. To. there is no given
Contact author: Jabber: wirl@exploit.imIf you configure the config of Chrome, Edge, Opera, then set this parameter (Works in Chrome with version 63, Opera50 and Edge17 version). The most popular values are "2", "4", "8".
ncognito -parameter shows whether incognito mode (private mode) is enabled or disabled in the browser. For work, set only "False".
Incognito mode in the browser is when the browsing history, cookies, autocomplete, etc. are not saved. An excellent option for schoolchildren to watch porn so that the mother or father burns))
Setting the language in the config
Three parameters are responsible for the language in the config in antidetects. Two navigator (language, languages) one in browser headers (HTTP_ACCEPT_LANGUAGE)
Navigator.language- this parameter shows the language of the browser interface (that is, roughly speaking, which language of your browser, and not the system, this will be displayed in this parameter.) Example: "en-US", "en-GB", "ru-RU" " etc. This parameter is composed as follows:
[Name of Language] - [Country codes]
NameofLanguage - below is a link to a list of all languages and designations: http://www.loc.gov/standards/iso639-2/php/code_list.php(select value from "ISO 639-1 Code")
Countrycodes - below is a link to a list of all languages and designations:
https://www.iso.org/obp/ui/#search/code/ (take value from "Alpha-2code")
Navigator .languages - this parameter shows the preferred languages of the user and is taken from HTTP_ACCEPT_LANGUAGE
Example: "en-US, en, ru-RU, ru", "de-DE, de, en-US, en"
The parameter is composed like this for EACH language (each language is separated by a comma without a space):
[Name of Language] - [Country codes], [Name of Language]
HTTP_ACCEPT_LANGUAGE - this parameter shows the preferred languages that the user can understand (system language, browser interface language) and the "preference" of the language.
Example: "ru-RU, ru; q = 0.9, en-US, en; q = 0.7"
The parameter is composed like this for EACH language (each language is separated by commas without a space):
[Name of Language] - [Country codes], [Name of Language]; q = [quality values]
qualityvalues- the meaning of the "preference" of the language. It can range from 0.1 to 0.9. The higher, the preferable the language. I advise you to set for the main language from 0.6 to 0.9, for the second from 0.4 to 0.7.
In the sphere, to configure the language parameters, you just need to configure HTTP_ACCEPT_LANGUAGE
Contact the author: Jabber: wirl@exploit.im ( https://prnt.sc/lypoyp ). The easiest way to change the language without HELL is just to change the language in your browser. The log also contains information about the user's language and the languages of the keyboard layout.
Configuring Screen Parameters
Move on to the parameter settings that relate to the user's system screen. I will not go into theory too much, I will try to explain these parameters very simply in practice.
First, let's see the main screen parameters in LinkenSphere, clearly in the screenshot:
http://prntscr.com/lz6cwt
Screen.width | device-width - these parameters show the screen width in pixels. Of course, in some subtleties, these are different parameters, but within the framework of our article I combined them, since the values will be the same.
Screen.height | device-height - these parameters show the height of the screen in pixels. Combined for the same reason .device-width and device-height in the scope to customize in the general settings (Physicalscreensize).
Screen.width and Screen.height adjust in the session screen setting (NOT in Extendedsettings)
Screen.availWidth- this parameter shows the width of the screen in pixels that the browser can occupy. In the screenshot, we have the taskbar at the bottom, therefore, it is associated not with the width, but with the height; the browser may take full length. Therefore Screen.availWidth = Screen.width | device-width
Screen.availHeight - this parameter shows the screen height in pixels that the browser can occupy. In the screenshot, in order for the browser to occupy the full height, the taskbar "interferes", so this parameter will be calculated as Screen.widthMINUS taskbar height.
Let's look at the examples from the first part of the article, when we looked at the taskbar there.
Now in even more detail and with an example. Let's take a FullHD1920x1080 screen. If the default taskbar (at the bottom, with large icons as in the screenshot), then its height will be 40px. With these values, "Screen.availWidth" will be 1920, and "Screen.availHeight" will be 1040px (1080-40 = 1040)
If the icons in the taskbar are small, the taskbar height will be 30 px, and the “Screen.availHeight” value will be 1050px
If the taskbar is hidden, the "Screen.availHeight" value will be 1080px.
The story will be exactly the same if the taskbar is located not at the bottom, but at the top.
Further, the taskbar can be placed to the right or to the left, and then the "Screen.availWidth" parameter will change. By default it will be 1858 (1920 MINUS taskbar width 62px). If the icons are small, then with this arrangement of the taskbar nothing changes in the width of the panel, and the value will be 1858; if the taskbar is hidden, then the value will be 1920.
That's why we looked at the taskbar from the screenshot in the log.
Screen.availTop - shows the first top (vertical) pixel screen coordinate that is not occupied by the taskbar.
Screen.availLeft - Shows the first top (horizontal) pixel screen coordinate that is not occupied by the taskbar.
If the taskbar is located at the bottom or on the right, these parameters will have a value of "0". Exception: if there is a second monitor, then the "Screen.availLeft" parameter can be negative or even positive.
If the taskbar is located at the top or on the left, then these parameters will have values depending on whether the icons are large or small. If the taskbar is hidden at the same time, then these parameters will have the value "0".
Otherwise: if the taskbar is on the left by default, then "Screen.availLeft" will have a value of 62px, if the taskbar icons are small, then also 62px (since when it is placed sideways, the width does not change)
If the taskbar is at the top, then " Screen.availLeft ”will have a value of 40px, if the taskbar icons are small, the value will be 30px.
Simply put, Screen.availTop shows the height of the taskbar if it is at the top, Screen.availLeft shows the width of the taskbar if it is on the left.
Knowing the location of the taskbar about the screenshot of the screen in the log, we can calculate these parameters.
The above values are valid for a FullHD screen of 1920px by 1080px.
In the attachments of the theme (at the very bottom), I attached the simplest, but very convenient checker for calculating the parameters of the screen and browser window. I am not a programmer and I am not fond of this, so the checker works correctly and stably only on Chromium browsers (Chrome, Opera). Therefore, you should not use this checker on Firefox. I hope there is someone who knows jQuery and adapts this simple checker for Firefox as well.
As a bonus, a link to a table where I indicated the most popular screen resolutions for OC and calculated the parameters for different browser resolutions:
https://docs.google.com/spreadsheets/d/12KM12QLMdwdmBKDuxlM-uh31WZNMQ6hdlIz_QnipAVg/edit?usp=sharingand
Screen.colorpthixthix - these parameters show the quality of color reproduction. The values of these parameters are the same. Possible values are "24" and "32". Within the framework of our article, we put only "24". The value "32" has such devices as Iphone, Ipad, etc.
Screen.orientation - this parameter displays information about the screen orientation. The easiest way to explain this is with a screenshot. https://prnt.sc/lz7j8w
We use only the landscape-primary parameter within the PC, the rest of the parameters are for mobile devices, tablets, etc.
Screen.angle - this parameter shows the screen rotation angle. "Landscape-primary" value0;
"Portrait-primary" value90; "Landscape-secondary" value
180 ; "portrait-secondary" value 270 First, let's see all the main parameters of the browser window in LinkenSphere clearly in the screenshot for better understanding (the screenshot was honestly stolen and modified): https://prnt.sc/lz7r9g
View the setting will be with two options:
1) Full-screen mode, when we expand the browser to full screen.
2) Windowed mode, when the browser occupies only some part of the screen. The screenshot shows just this option as an example.
The screenshot above demonstrates these parameters perfectly, and how they differ from others. If the browser is in full screen mode, the volumes can be specified with exact values. If we work in windowed mode, then there can be a huge variety of values, the main thing is that the values are "consistent" with other parameters (innerWidth, client.Width, innerHeight, clientHeight, screenLeft, screenTop, screenX, screenY). The best and easiest way to get values for windowed mode is to use the script that I attached to the theme.
In full screen mode, these parameters correspond to the parameters "availWidth" and "availHeight"
Window.innerWidth and body.clientWidth- these parameters show the value of the width of the working area of the browser, in other words, the entire width in pixels to which your sites are loaded, excluding the width of the scroll, the taskbar, if it is placed on the right, and other elements that narrow this width. I combined these parameters, since they will coincide within the framework of our article.
Window.innerHeight and body.clientHeight - these parameters show the height of the browser's working area, in other words, the entire height in pixels to which your sites are loaded, excluding the horizontal scroll height, the height of the tab area, the height of the URL line in the browser and other elements that reduce this width ... I combined these parameters, since they will coincide within the framework of our article.
These parameters are the most dynamic and unpredictable in comparison with other parameters. Even in fullscreen mode, besides outer.Width / Height, a bunch of other windows are affected.
For example, in GoogleChrome, the setting of the browser appearance settings ("Show bookmarks bar") affects whether the downloaded files bar is displayed in the browser (Example: http://prntscr.com/lzd3r5), etc.
In Firefox, the settings in the "Customize" section affect ( https://support.mozilla.org/en-US/k...e=en-US&redirectslug=Navigation+Toolbar+items). Specifically, the Toolbars (Menu, Tab, Title) parameters, the "Density" parameter.
And so in each browser, different settings affect these values.
In windowed mode, in addition to these parameters, the parameters “screenLeft, screenTop, screenX, screenY, outerWidth / Heght) also affect.
In any mode, the devicePixelRatio parameter affects, but more on it below. Again, the best and easiest way to get the values is to use a script.
In the table I will give setting options for different screen resolutions in full screen mode with default browser settings.
https://docs.google.com/spreadsheets/d/12KM12QLMdwdmBKDuxlM-uh31WZNMQ6hdlIz_QnipAVg/edit?usp=sharing
window.dexicePixelRatio- this parameter shows the ratio of the size of the physical pixel to the logical one. In simple terms, as far as our browser types are concerned, it is the page scale parameter. By default, it is 100% and the parameter is "1". If we increase the scale of the page or decrease it, then this parameter changes. We increased the page scale by 125%, the parameter changed to "1.25", reduced the page to 90%, the parameter changed to "0.9".
Clarifications : changes to this parameter affect the parameters “Window.innerWidth, body.clientWidth, Window.innerHeight, body.clientHeight) in full screen mode and in windowed mode.
To change the parameter naturally, you need to use the increment or decrement step as in a real browser. Example:
Firefox browser scale values: "50%", "60%", "70%", "80%", "90%", "100%", "110%", "120%", "130%", " 140% ”, etc. (10% step)
Browser Chrome scale values:“ 33% ”,“ 50% ”,“ 67% ”,“ 75% ”,“ 80% ”,“ 90% ”,“ 100 % "," 125% "," 150% "," 175% "," 200% "," 250% "," 250% ", etc. (Dynamic step).
And so for every browser.
One more subtlety with the values of this parameter. Let's take the Chrome browser:
100% -value of the parameter "1"; 110% the value of the parameter is not "1.1", but "1.100000023841858"; 125% value of the parameter "1.25". Those. the meaning may not always be exactly the same; in different browsers in different ways
The last subtlety: the size of the working window, decreases or increases NOT EXACTLY by the value of devicePixelRatio. Those. if we increase the scale by 25%, it does not mean that the height of the browser work area will decrease EXACTLY 25%. The percentage values will be different.
window.screenLeft and window.screenX - these parameters show in pixels how far the browser window in windowed mode is shifted to the right of the first pixel.
window.screenTop and window.screenY - these parameters show in pixels how much the browser window in windowed mode is shifted down from the first pixel
In the screenshot, I clearly showed these parameters. Combined these parameters, since they are the same within the framework of our article. All of these parameters are used in the browsers Chrome, Opera, Edge. Mozilla Firefox browsers use only these parameters: ScreenX and ScreenY.
If the browser is in full screen mode and the control panel is at the bottom or on the right, then these parameters are equal to "0".
If you use full screen mode in the browser and the control panel is on the left or on the top, then the values of these parameters are equal to the width or length of the control panel.
If the windowed mode of the browser is used, the parameters will depend on how far they are shifted from the left first pixel of the screen and the top first pixel of the screen. It is best to use a script to calculate these parameters. These parameters do not directly depend on the Outer.Width / Hegiht, innerWidthHeight parameters, i.e. the rule "Screen Width = screenLeft / screenX + Outer.Width" DOES NOT WORK, since there are no parameters responsible for the right and bottom sides of the screen, and, therefore, the value of "outer.Width" with a value of screenLeft / screenX 50px can be the same as 600 px Both 500 px and 900 px - it all depends on how much we "stretch" the browser window in width. This rule also applies to screen height.
window.pageXOffset- this parameter shows how much the page is scrolled to the right (vertically in pixels) using the scroll bar relative to the upper left window.
window.pageYOffset - this parameter shows how much the page is scrolled down (horizontally in pixels) using the scroll bar relative to the upper left window.
For a better understanding, see the screenshot.
In full screen mode, the window.pageYOffset parameter is dynamic, because on almost any large popular site, we scroll down the page, rarely when the site completely fits into the working window, the main page of google search does not count.Therefore
, it is best to simply NOT change this parameter.
In full screen mode, the window.pageXOffset parameterfor the most part it is equal to "0", since sites are adapted to different screen resolutions, and side scrolling is wildly inconvenient. But if we have a windowed browser mode, then it can also be, depending on the site and the size of the browser window.
Therefore, it makes no sense to set constant values for these parameters. As for me, if we really take a substitution, then the only possible sense is to make it random within any values
Configuring plugins in the config
I described plugins in detail in section 1 of the article. In new versions of Chrome, Firefox, Opera, Edge, there are only built-in plugins and 1 plugin that can be installed -AdobeFlashPlayer. There are two types of AdobeFlashPlayer: AdobeFlashPlayer ** NPAPI - Firefox subbrowser. AdobeFlashPlayer ** PPAPI - Opera / Chrome subbrowser.
Now we'll take a closer look at how to customize plugins and what variations you can make.
Firefox has two built-in plugins by default "WidevineContentDecryptionModule" and "OpenH264 VideoCodecprovided", but these plugins are not shown when requested.
In Firefox, the only plugin you can add is Flash. Subtleties: when installing in the Flash system, the default setting is "AsktoActivate"; with this setting, Flash is shown only when the site is requested; the plug-in does not light up in the checkers; if the "AlwaysActivate" parameter is selected, then the physical Flash and the plugin are lit. Therefore, by installing Flash into the system, we can uniqueize this fingerprint without an antidetect.
With antidetect, we have two options: either we add a Flash plugin, or we don't. If we add, then we have different variations in the form of Flash versions. This gives us the ability in different configurations to make a different Flash plugin, and not add the same one. Below there will be a link to a table for the type of Firefox browser, how the Flash setting looks in the plugin, as well as a list of different versions. As a reminder, in the realm, plugins are configured in "Extendedsessionsettings".
https://docs.google.com/spreadsheets/d/1BPCD97WmsiSsHoFDZ3MJjtbbvtqBMgpJfXpF4SGnjc0/edit?usp=sharing
GoogleChrome has 4 plugins by default, some of them can be enabled / disabled; the only plugin that can be added is also Flash.
Plugin parameters are static by default; they don't change. The Flash plugin has the same parameters that change depending on the version of the plugin and depending on the bitness of the system: 32-bit; 64-bit. More about default plugins:
ChromePDFPlugin and ChromePDFViewer - these plugins are responsible for PDF documents in Chrome and allow, for example, to open PDF directly in Chrome online, without downloading the file to your computer. These plugins are linked; so you either add both plugins to the config, or neither. You can turn it on / off in a regular browser in Advanced settings -> Content settings -> PDF documents.
WidevineContentDecryptionModule- this plugin is responsible for prohibiting copying of audio and video content by the copyright holder. Since version 57 of Chrome, the plugin cannot be disabled. But at the same time, I have repeatedly seen in systems and configs that this plugin did not glow, although the versions of Chrome were one of the most recent.
Native Client - the plugin is responsible for launching some online games and applications. You cannot disable it, so this plugin is added 100%.
Here is a table for configuring plugins in the sphere for the type of Google Chrome browser and variations of settings with Flash:
https://docs.google.com/spreadsheets/d/1BPCD97WmsiSsHoFDZ3MJjtbbvtqBMgpJfXpF4SGnjc0/edit?usp=sharing
In the Opera browser, everything is identical.
1) The names of the plugins responsible for PDF are different. Instead of "ChromePDFPlugin" the value is "Chromium PDF Plugin"; instead of "Chrome PDF Viewer" value "ChromiumPDF Viewer".
2) There is no Native Client plugin.
3) Plugin "Newsfeedhandler". Responsible for feeds, i.e. for receiving content from the site directly into the browser using the RSS protocol. Activated by default. Therefore, we add this plugin
Here is a plate for configuring plugins in the sphere for the browser type Opera and variations with Flash:
https://docs.google.com/spreadsheets/d/1BPCD97WmsiSsHoFDZ3MJjtbbvtqBMgpJfXpF4SGnjc0/edit?usp=sharing
Setting the font list
All antidetects on the market allow you to replace the font imprint. The configs of most antidetects contain a list of fonts. The sphere allows you to conveniently edit the list of fonts in the config or create from scratch by loading font names from a file.
In the system itself, without an antidetect, you can very easily edit the list of fonts. To do this, go to the control panel -> design and personalization -> fonts.
There you can add new fonts after downloading them, delete existing fonts. By performing such manipulations, we change our list.
On each system, due to the installed various programs and other factors, the list of fonts and the number of fonts will be different. But there are basic fonts for every version of OCWindows.
List of base fonts and their styles for
Windows7https: //docs.microsoft.com/en-us/typography/fonts
/ windows_7_font_list List of base fonts and their styles for Windows8 https://docs.microsoft.com/en-us/typography/fonts
/ windows_8_font_list List of base fonts and their styles Windows10https: //docs.microsoft.com/en-us/typography/fonts
/ windows_10_font_list You can use
these base fonts as a starting point for your list. Some clarifications: all links of the font family are clickable. Inside you can find information about which Windows operating systems and programs use a given font family. You do not need to specify all font styles in the list, you can only specify the font family. Check the font families on the site; for example, the "Wingdings" family actually contains 3 fonts.
Here's a great list for building your font list. It lists a large number of fonts and which Windows operating systems and programs use them.
Configuring the substitution of WebRTC and.MediaDevices.enumerateDevices
.MediaDevices.enumerateDevices - this function allows you to get a list of all devices (audio and video devices of the system, USB cameras, microphones, etc.). You can get deviceID of device data, device name and device type.
The function in LinkenSphere has settings: "True" - the function is enabled, but the parameters are not overwritten. "False" - the function is disabled, "Fake" - the function is enabled; parameters are overridden.
In our types of browsers, we only use the "Fake" parameter.
Moving on to configuring WebRTC, we will use spoofing on all types of browsers, which we are discussing with you today. Let's consider some subtleties.
1) Checkbox IPv6... Enable this checkbox if your system is leaking ipv6. You can check it here: https://browserleaks.com/ip
(item "IPv6 Address") 2) External (Public) IP in WebRTC. Everything is simple here: the external IP matches the IP of your sock or tunnel. But when working with syllables, I also met such an unusual approach. Its essence lies in the fact that the external IP is set to the user's IP system. Yes, at the same time, checkers will show that it is wrong, but this approach takes place.
3) Internal (Local) IP in WebRTC. This is also kind of simple: there are local IP ranges that can be used.
10.0.0.0 —10.255.255.255
172.16.0.0 —172.31.255.255
192.168.0.0 —192.168.255.255
But again, there are subtleties. Let me remind you this plate:
https://docs.google.com/spreadsheets/d/1GySRwS_QAmvPSJEDxYcsGnz_7Vu_mtj0nn_RvY4wgl4/edit?usp=sharing
So, there is a Default Local IP column. This is the local IP router by default, by which you can just get into its settings. Therefore, it is better not to set these IPs when setting up the config.
The next trick is to work with logs and local IP. In the first part, we tried to find out the approximate brand of the router, and ideally its model. So in some cases, we can assume an approximate local IP address.
In general, where does this local address in WebRTC come from on your system? Most routers have a DHCH server in their settings. The DHCH server assigns a local IP to each device that connects to the router. Usually, the DHCH parameter settings are something like this, depending on the brand and model of the router: Start IP, End IP and the time for which the IP address is issued. Let's take, for example, that the router has the following settings:
Start IP: 192.168.0.2
End IP: 192.168.0.100
Time: 1440min (24 hours)
We connect our laptop to the router, the DHCH server gives it a local IP: 192.168.0.2 for 24 hours; We connect our mobile phone, the DHCH server gives it a local IP: 192.168.0.3 for 24 hours; we connect our refrigerator with Wi-Fi to the router, the DHCH server gives it a local IP: 192.168.0.4 for 24 hours, etc. Let's say 12 hours have passed, the lights were turned off, and the router rebooted; and the refrigerator was the first to connect to our router. Now the DHCH server gives him the local IP: 192.168.0.2 for 24 hours; then the mobile phone connected - the DHCH server gives it a local IP: 192.168.0.3 for 24 hours; then the laptop connected, the DHCH server gives it a local IP: 192.168.0.4 for 24 hours.
Thus, in this example, it can be seen that the local IP is a dynamic parameter and can vary within the limits specified in the DHCH server setting in the router.
Knowing the brand of the router and the approximate model, you can look at this IP range, and put the approximate local IP in the log. Again, in the example above, the owner has a D-Link router; we have defined the start and end IP. The owner, most likely, has 2-4 more devices in addition to the computer that are connected to the router (for example, a phone and a TV). Therefore, we can safely set the local IP "192.168.0.2" or "192.168.0.3" or "192.168.0.4" or "192.168.0.5". On the Internet, you can find emulators of most popular routers and see the base IP range in the settings; in the table I also added the initial and final IP to some models.
Configuring substitutions in the config.
Although this does not apply to setting up a real config, I will go through some of the features. You can find a bunch of different information about all the prints that the sphere replaces, so I will not describe the same thing 10 times
About the use of substitutions: I advise you to use all the substitutions in any of our browser types, but with some subtleties.
1) EnableFlash - enables Flash. Turning on flash unnecessarily is not recommended by every author of an antidetect, as this is an additional variation to detect you. As for the use of Flash, they can advise such options, it does not matter whether we create a config for working with a log or a config of any of the browser types:
A) Add Flash to the config plugins, but leave the physical flash (enableflash) disabled. Here we get an interesting situation, for plugins we have it as it is, but there is no physical version.
B) Add Flash to config plugins and enable physical flash (enableflash). I described the disadvantages of this option above.
One more point, in some antidetects you can configure Flash settings, so if there are such settings, and you decide to use Flash, be sure to remember to configure them (such parameters as OC, language, screen resolution, Flash version, etc.)
2) Canvas substitution. We enable this substitution, but now I will write options when you can try to disable this substitution in our browser types.
There are only two of them: A) When the created config has the same browser type as the antidetect, i.e. LinkenSphere is written on the basis of Chromium, therefore, if you create a Chrome configuration, it is allowed to disable spoofing as an option. The second option is a little worse: this is when the browser is made in the Chromium shell. In our case, this is the browser type: Opera.
3) Substitution of AudioFingerprint. Substitution of course must be enabled. But audio also has parameters ( http://prntscr.com/lyqeto). Some of them can be changed in the system, so below there will be information for thought: as an option, in addition to the print, they can also be replaced. For example, the first parameter on the screen (ac-sampleRate) is very easy to change: for this you need to change the DefaultFormat (https://prnt.sc/lyqgop)
Tips, Tips, life hacks using the Linken Sphere antidetect and when working with logs.
1. Installing LinkenSphere: Virtual Machine or Base?
Should I install on a Virtual Machine or on a Basic Machine? Also a very popular question. Again, you can find the best option for you. LinkenSphere on the Main Machine
Pros:
1) Convenience of work
2) Does not require large resources of RAM, less load on the computer compared to using a virtual machine, for example, on Win10 x64, especially if the paging file is disabled for security and the PC is not very powerful.
3) If suddenly there is some kind of detection or detection of a virtual machine in the world that no one knows about yet, then this will undoubtedly be a plus compared to using an antidetect on a virtual machine. Let me explain in more detail what I had in mind: Almost any antidetect in the world, if it does not replace any parameter, then it is most likely taken from your system, or simply disabled.
4) Security. I do not presume to say 100%, but from a security point of view, in the chain of anonymity, perhaps this option is worse than using
LinkenSphere on a Virtual Machine or a server. LinkenSphere on a Virtual Machine. Here it is still the other way around, and the minuses become a plus, and the pluses become minuses.
3 use case: some people use LinkenSphere on a dedicated server, which is also an interesting option in its own way, which has some advantages from those two options above.
2. What type of configs is better to use for driving. "Good" options for using configs for different types of OS.
Actually, given that this Antidetect is written on the source code of the Chromuim engine, it is ideal to use configurations with the Chrome browser and browsers based on the Chromium platform.
If LinkenSphere is on your OCWindows, then "good" configuration options are:
1) Win XP, 7.8, 10 + Chrome
2) Win XP, 7.8, 10 + Opera
3) MAC OS + Chrome
4) Win10 + Edge ( Most recently, Microsoft announced the replacement of the engine with Chromium)
Mobile options:
1) Android + Chrome
2) Windows Phone + IE (Internet Explorer )
3) Iphone, Ipad + ChromeEsli LinkenSpherestoit you to OCMACX, the "good" config options:
- the MAC OS + the Chrome
- the MAC OS + the Safari
- Win + ChromeMobilnye options:
Of course, you can use any config of any OS, but these are preferable due to the fact that the OS and / or platforms are the same.
3. Life hack: Using "Non-standard" configs when driving
As a good and unusual alternative to those variations that I wrote above, there can be the use of "non-standard" configs. In my understanding, non-standard configs are those systems that are not common in general and that are rarely used for driving. For the sphere and some other blood pressure, the criterion may still be that these configs cannot be found in the configshop. I will give examples of such configs: XboxOne, PlayStation4, Blackberry, PlayBook, Kindle, etc. It is difficult, of course, to imagine holders driving from Playstation4 or PlayBook, but nevertheless, these options take place in some topics and as one of the factors of "non-standard" driving ...
How to get these configs for a sphere? There is only one option - to do it yourself. After reading the entire manual, it will be more or less clear to you how to make configs. The only problem is, where can I get all the data (UserAgent, WebGL, WebRTC, Window.Screen, Window.Navigator, etc.) for these devices? Everything is very simple here) Either look at a real device for all the necessary checkers, or take it from the configs of another antidetect.
4. Using the "WebEmulator" tool
WebEmulator is a tool in LinkenSphere that allows you to automatically visit a list of sites, mimicking human behavior. This tool is useful in that it automates the process of receiving cookies, thereby reducing our time spent on routine work, i.e. you enter a list of sites, turn on the emulator, and wow, we already have a browser for cookies of various sites.
In practice, this tool is very useful, because shop antifraud systems may well collect and analyze your cookies. Thus, using this tool correctly, we will be more like an ordinary user.
According to the settings of this tool (Screenshot: https://prnt.sc/jkvy3p)
We put a check mark on Disablepopups (disable pop-ups) and Enablealertaftercomplete (Enable notifications after WebEmulator exits). MaxVisitedPage is how many maximum pages on each site will be open. Here, everyone decides how much to bet, I would recommend from 3-4 to 12-30. Maxtimeonpage, min - I would recommend setting from 30 seconds to 2 minutes.
Startdelay - this item is responsible for the delay (in minutes) before starting to turn on the emulator itself. It's up to you.
Each site must be specified on a new line and with httpS: //.
About the list of sites. I would recommend everyone to make their own list of sites to bypass, depending on the country of your drive (in my case, this is USA). In my list, I would have collected about 30-40 such sites, in order to be able to alternate between different sites, and not every time to bypass the same ones. For example, TOP sites by ALEXARANK: (https://www.alexa.com/topsites). There you can select the TOP 500 sites for different countries, find out the average depth of page viewing, the average duration of users' stay on the site for the last 3 months.
5. DetectSocialMediaLogin
http://www.tomanthony.co.uk/tools/detect-social-network-logins/
Here is a typical public example of a demonstration that sites can easily see if you are logged into popular social services. Therefore, in order to be more like a real user's PC, you need to create accounts in popular networks and log in to them immediately before your work (well, or buy ready-made accounts). The most popular services: Facebook, Twitter, Gmail, Youtube, Google+, Instagram, Pinterest, Battle Net, Xbox, PSN, Tumblr, etc.
This rule also applies to logs. We look in the accounts, what popular social services our user has, log in to them (if we do not automatically get it with the help of our cookies) and only then go to the sites we need.
Now let's move on to working with logs.
By all parameters, all logs can be divided according to the degree of importance (in descending order of importance):
1. A log that has a set of standard services complete with BA and cryptocurrency exchanges.
2. Log, which has a set of standard services such as Paypal, Amazon, various shops
3. Log, which has a couple of services / not interesting small shops; The cookies for this log are not particularly admirable for us.
4. Useless log
For beginners, first of all, there will be advice not to disdain category 2 and 3 logs, treat them with the same seriousness as logs in the first category in order to gain experience, get your hand, technically learn how to use the log and the chosen a tool for processing it.
On the forums, spent logs of different categories are often distributed; this option is also a good way to start working with logs.
You can determine the degree of importance by the Logins / Passwords of the log, auto-fill, and sometimes even by the splash screen on the desktop, you can distinguish the log of a schoolboy from a good log. With experience, depending on your skills, financial situation, you yourself will determine once or twice with which log to work painstakingly, with which not very much, and which one should be thrown out and not wasted your time. Working out logs in Linken Sphere is very convenient because, using different tabs, you can process several logs at the same time, which also saves time. Log processing can be complex, or processing for one specific request. It often happens that newbies work out logs for only 1 request, for example, on Paypal, and if they can't work out, they get upset and throw out the log. This is a bad way of working because with it you will not get a normal profit and knowledge; if you have a lot of time and little experience, work out the log to the fullest, fill your hand. Let's move on to interesting tips and life hacks when working with logs.
1. Determine your "attack vector". Simply put, you need to understand where the holder has money, what means of payment he uses most often. You can view the popular payment methods of the holder in Amazon, Paypal, Ebay, etc.). After you have determined where the money is, you need to try to find out how much money is kept by the holder, if possible. To do this, you need to get into online banking, look at statemans, etc.
2. Operator services such as AT&T, Verizon and others may have the function of blocking a SIM card, losing a phone and other useful things that can complicate the restoration of the holder's access, or even complete loss.
3. Always put messages from unwanted services and shops from which messages may come in the mail of the holder in the spam filters. Redirect the necessary messages through filters to your mail.
4. Check all cloud storages (Googledrive, icloud, onedrive, dropbox, etc.) There are great chances for PhotoID, DriveLicense, CreditCards, WalletSeed, 2FA and other useful information.
5. Live the life of a holder. After collecting all the information on the holder, read it on Facebook and other social media. networks, look where he is going tomorrow, when he is not at home, when he is in the hall, when he eats, with whom he fucks, this will help to compose a psychological portrait for psychological influence, as well as give the opportunity to choose the best attack time
For example, you can urgently call holder to work, send a wreath with threats
6. Leave behind backdoors. Put your secret questions on mails, link up your 2FA, phones, backup mails. Then, with a high probability, the holder will not be able to quickly and painlessly return his account, and even if he does, he may not notice your backdoor, which you can use again.
7. Passwords. Many holders use the same passwords, therefore, even if the required service is not in the log, you can choose it yourself by brute-force
8. Activity. By letters in the mail, you can determine the most popular and freshest by date services that the holder uses. From them choose the right ones - those that you know how to work out. These services will be more fraud-loyal, since the holder often uses them, and, therefore, they have more recent cookies compared to other services.
Getting basic information from the system log. In the log, the most basic information about the system is contained in the System.txt file, or Information.log. Screenshot: https://prnt.sc/lx4rp1 In the screenshot I have highlighted the parameters that we need to configure the system.
1. Windows - This parameter contains information about the version of Windows and the bitness of the system (32-bit or 64-bit, 64-bit is much more common). Most often you will see the logs of Windows 7, Windows 10, less often - Windows8, 8.1, XP. We will need this parameter to configure "navigator.UserAgent" and some derivatives.
2. DisplayResolution- This parameter contains information about the user's screen resolution. Required to configure all settings related to screen resolution and browser window size and derived settings.
3. DisplayLanguage, KeyboardLanguages - These parameters contain information about the system language / languages. Needed to configure the parameters "navigator.Language", "navigator.Languages" and HTTP_ACCEPT_LANGUAGE.
4. CPUCount - This parameter contains information about the number of processor threads. Needed to configure the parameter "navigator.hardwareConcurrency"
5. RAM - This parameter contains information about the amount of RAM. Required for setting "navigator.deviceMemory"
6. Videocard- This parameter contains information about the system video card. Required for configuring WebGL. Please note that the system can contain two video cards: one discrete and the other integrated. This is usually used on laptops. And which of them runs for the browser is 100% unknown. Firstly, the user can manually set what kind of video card will be used, and secondly, for example, it can be like this: if the laptop is on charge, a discrete video card is used, but if it is powered by a battery, then it is an integrated one. Therefore, in laptops, you should not rely on this parameter 100%.
7. [Network]We take almost all parameters, except Geo (Latitude and Longitude); This information will be useful to you for a more competent selection of Socks / SSH-tunnel. There is no ZIP in my log, but it is not difficult to break through it. To do this, you just need to punch the IP address through the MaxMind database, or find the user's home address in the browser autocomplete, or in the mail or in the shop. It is advisable to select the IP not only as close as possible to the ZIP address, but also, if possible, with the same IP mask and the same Internet provider.
Our next step will be to determine the type of browser and browsers to create the configuration. It happens that PC owners use multiple browsers, not just one. Therefore, if necessary, it is better to create two sessions in the sphere, i.e. two configurations, rather than loading cookies into one. To do this, we look at the sites we need with logins and passwords in the file "passwords.txt" parameter "Soft" Screenshot: https://prnt.sc/lx5ofi , as well as files in the "Cookies" folder for the presence of the necessary sites (files in this folder divided into browsers; it is possible that the Cookies files can be stored in a shared folder. It all depends on which style is logged with). Example: http://prntscr.com/lx5oag
In my case, there is only one GoogleChrome browser in the log, so I mark myself only 1 browser. Moving on to more interesting information that does not lie on the surface.
Determine if there is FLASH in the system and its version, determine the browser version (if possible)
To do this, go to the System.txt file, or Information.log and look for "Adobe Flash Player" in the [Software] section of the installed programs. If found, we mark that there is Flash, write down its version. There are two types of AdobeFlashPlayer: AdobeFlashPlayer ** NPAPI - Firefox subbrowser. AdobeFlashPlayer ** PPAPI-sub-browser Opera / Chrome.Screenshot: http://prntscr.com/lx5ztv
Next, on the same screenshot, we see the version of GoogleChrome, if not, then we try to find it in the file by the query "GoogleChrome". We also mark the version for ourselves. We will need the type of browser and its version to configure the "navigator.UserAgent" parameter, and, in exceptional cases, to disable Canvas substitution. Browser MozillaFirefox search for "Firefox", we should find something like this "MozillaFirefox64.0 (x64 en-US) [64.0]". The name of the Firefox browser contains the bitness of the program (32 or 64bit), which is also useful in setting "navigator.UserAgent". Opera browser search for "Opera", we should find something like this "OperaStable57.0.3098.106 [57.0.3098.106]"
For various reasons, it is not always possible to determine the version of the browser, one of which - the browser may be Portable, i.e. not installed on the system. IE browser will not be visible, because it is already natively in Windows, with Edge in Win10 the same hat.
We need Flash and its version in order to add it to plugins and, if necessary, enable its physical version in the antidetect.
Determine the user's desktop or laptop.
You can determine this using various options.
1. According to the screenshot of the screen in the log. On the screenshot of the screen, we are looking for something that is characteristic of a laptop on the taskbar in the lower right corner, or on the desktop for something that is characteristic of a laptop (software icons for a laptop, etc.)
On the taskbar, you can find Battery icon, Wi-Fi connection icon. Now I will show this with examples.
Examples:
http://prntscr.com/lx86z7
https://prnt.sc/lx871y
2. By information about the processor in the system. To do this, go to the System.txt or Information.log file and look at the Processors parameter Screenshot: https://prnt.sc/lx88az
Copy the value and google information about the processor. Here is an example of information on this processor from the Intel website, which shows us that the user has a desktop computer. Screenshot: https://prnt.sc/lx89jp
An example of information about a processor for a laptop. Screenshot: http://prntscr.com/lx8g8y
Well, another option is to search in processes or installed programs in the System.txt file, or Information.log for processes / programs that belong to the laptop. For example, these are processes in which the keyword "Bluetooth" appears, programs specific to a particular laptop manufacturer (ASUS, DELL, MSI, ACER, etc.).
Examples of processes: "Intel (R) Wireless Bluetooth (R)", "Dell Touchpad" ...
It is necessary to know several options, because sometimes the screenshot may not be there, or the screenshot is obtained in a certain area without the taskbar, sometimes the taskbar is hidden.
Taskbar: determine the position of the taskbar on the screen, the size of the icons and whether the taskbar is hidden (if possible)
The first question that comes to mind: "Why the heck do you need it?" The answer is: this is necessary in order to set the screen size; the size of the browser window and the size of the working area of the browser in full-screen mode of the browser (parameters "window.innerWidth", "window.innerHeight", "window.outerHeight", "window.outerWidth").
Of course, not every log will have such an opportunity to look at and understand 100% of everything. Sometimes a screenshot may not be available, there may be a screenshot of an incomplete screen area
Now I will show you how to correctly evaluate these parameters . Screenshot : https://prnt.sc/lxy3x0
These examples are made on OCWindows7. If you wish, you yourself can then look and play with these settings on any OCWindows
1) Position of the taskbar. Happens: horizontal and vertical. For most users, the default position is horizontal.
2) The size of the taskbar icons. There are two sizes of icons: large and small. By default, the size of the icons is large. Most users have large icons. On Windows7 there is a peculiarity: if the icons are small, then the icon of the "start" button protrudes beyond the taskbar area. Sometimes it is not always possible to understand the size of the icons even from the screenshot, I advise you to also pay attention to DisplayResolution in the log; One thing is a screenshot of the screen size "1024 x 768", another thing is "2560 x 1440"
3) Hidden taskbar. By default, the taskbar is not hidden for most users. A hidden taskbar doesn't mean it's not there at all. It just does not appear on the screen, but appears when you hover the mouse cursor. If you have a full screenshot of the screen in your log and there is no taskbar there, then it is just hidden.
4) If in the screenshot the owner of the PC has the type of browser you need open, mark this as well, it will be useful in setting up. Screenshots with an open browser are quite common.
User's network: we define an approximate router and its model (if possible)
Sometimes, from the log, you can determine the brand of the user's router or its approximate model. It may be necessary for more precise configuration of WebRTC, or rather, LocalIPAddress.
To do this, you need to look in the log in the file with logins / passwords or in the file where the browser history is stored, the popular IP address masks of routers. Here is a link to the table of brands of the most popular routers and default local ip addresses:
https://docs.google.com/spreadsheets/d/1GySRwS_QAmvPSJEDxYcsGnz_7Vu_mtj0nn_RvY4wgl4/edit?usp=sharing
The most popular masks for searching in the log. "," 10.1. "," 10.90. ". I highlighted the most popular brands in light blue in the table.
If there will still be a login and a password, you can try here to look at the brands of the standard login / password bundles by brands:
https://192-168-1-1ip.mobi/default-router-passwords-list/
For example https://prnt.sc/ly3sww[/URL] assume that the PC user has a D-Link router. But this is not 100%, since several more routers have the same bundle.
The browser history file can sometimes show us much more accurate information. Here's an example: https://prnt.sc/ly41tw
In the browser history, we see LocalIPAddress plus the page title, which gives us a huge plus in defining the router.
If you google "B593s-931", then you can determine that this is the name of the router "HUAWEI B593s-931". Another example: https://prnt.sc/ly49nx If you google "userRpm / DdnsAddRpm.htm", you can see that the router belongs to TP-LinkTL-WR741N / ND, or TL-WR841N, or some others.
In addition to LocalIPAddressWebRTC, the information will be useful if someone changes the MAC address, since the "beginning" of the MAC address is different for each manufacturer.
Browser plugins: identify popular plugins that are installed in the browser.
Plugins in any program are add-ons that allow you to expand its capabilities. Most of the popular browsers have the ability to install plugins that extend its capabilities. For example, it can be a Flash plugin from Adobe, the ability to read PDF pages in a browser; in Chrome, this plugin is already included by default; the ability to run any Audio / Video codecs.
With each new release of updates, the number of new features and variations of the supported content increases, so plugins are gradually losing their relevance. As a result, in the browsers Chrome, Firefox, Opera, Edge, there are only built-in plugins and one added: AdobeFlashPlayer. Therefore, the search for plugins is more relevant for the InternetExplorer browser, or for older versions of Firefox (up to version 52), Chrome, Opera.
Most popular plugins: Flash, Java, MicrosoftOffice, Adobe PDF Reader, Windows Media Player, Real Video / Audio.
At the beginning of the article, we already determined whether Flash is on the system. So FlashPlayer is also a browser plugin. Therefore, if there is Flash, then in some types of browser it will be in plugins. We mark ourselves, if available.
We will also look for other plugins in the System.txt file, or Information.log in the [Software] section of the installed programs.
Plugin QuickTimenahodim on request «QuickTime», estimated plugin name: «QuickTime7 [7.79.80.95]»
plugin Silverlightnahodim on request «MicrosoftSilverlight», estimated plugin name: «MicrosoftSilverlight [5.1.50907.0]»
plugin Javanahodim on request «Java», approximate name plug-in: "Java8 Update191 [8.0.1910.12]"
RealPlayer plug-in found by request "RealPlayer", the approximate name of the plug-in: "RealPlayer [18.1.15.]"
Plugin AdobeAcrobat (for reading PDF files) we find the query "AdobeAcrobatReader 19.0.0 .20064.] "
There are many other different plugins, this was just an example of popular plugins. The list can be continued for a very long time.
This completes the collection of information from the log. As a result, we have collected the following information: Windows: Windows 10 Home [x64] Display Resolution: 1920x1080
Windows: Windows 10 Home [x64]
Display Resolution: 1920x1080
Display Language: en-US
Keyboard Languages: English (United States)
CPU Count: 4
RAM: 8139 MB
VideoCard: NVIDIA GeForce GTX 970
[Network]
IP: 38.104.174.234
Country: United States (US)
City: Pleasant View (California)
ZIP: 93260
ISP: Cogent Communications (Txox Communications)
-
Browser: Google Chrome ver. 68.0.3440.106
Flash: available, ver. 30.0.0.154
-
PC: Laptop
-
[Taskbar]
Position: Horizontal
Icon size: Large
Hidden taskbar: No
Is there a browser in the screenshot: YES
-
Router: ~ TP-Link TL-WR741N or TL-WR841N
-
[Browser Plugins]
Adobe Flash
PlayerReal
PlayerAdobe
Acrobat
Of course this example has too much information. In practice, it may be less.
Manual for setting up real configs from scratch using antidetect.
Let's move on to the most interesting section of this article.
The basis of all the basics - UserAgent
UserAgent is the basis for creating a config. As building a house begins with a foundation, so creating a config starts with UserAgent (abbreviated as UA). Let's start with theory. Let's figure out what UA is.
UserAgent is a property (parameter) that contains properties used to determine which browser, which operating system, which version, and what specific software the user has.
In the configs of any Antidetect, this parameter is located in navigator.UserAgent and in HTTP_USER_AGENT.
Note : navigator.UserAgent and HTTP_USER_AGENT are always the same, but there is an exception: InternetExplorer browsers. Very often in these browsers, navigator.UserAgent contains information about the user's software.
Example:
HTTP_USER_AGENT: "Mozilla / 5.0 (Windows NT 6.3; WOW64; Trident / 7.0; rv: 11.0) like Gecko"
navigator UserAgent : "Mozilla / 5.0 (Windows NT 6.1; WOW64; Trident / 7.0; SLCC2; .NET CLR 2.0 .50727; .NET CLR 3.5.30729; Media Center PC 6.0; rv: 11.0) like Gecko »
Let's take a look at how to compose the UA of the most popular browsers in Windows. Let's start with the simplest - MozillaFirefox. UserAgent structure:
Mozilla / 5.0 (< Windows version >; <bit tags>; rv: <Firefox version>) Gecko / 20100101 Firefox / <Firefox version>
Above, I have highlighted the parameters that you need to know for creating a real UA.
< Windowsversion > - Operating system version. The options are:
Windows NT 6.0 – Windows Vista, Windows Server 2008.
Windows NT 6.1 – Windows 7, Windows Server 2008 R2.
Windows NT 6.2 – Windows 8, Windows Server 2012.
Windows NT 6.3 – Windows 8.1, Windows Server 2012 R2.
Windows NT 10 – Windows 10, Windows Server 2016 & 2019.
This parameter is available in all UAs on Windows. Note: on Edge browsers it is static, i.e. does not change, because the browser is sharpened just for Windows 10.
< bittags > - "bitness" of the system. I think everyone knows and everyone has met with the fact that there are two 32-bit Windows systems and 64-bit ones. It is the browser that transmits the possible variations:
Win64; x64 - this value is transmitted if the system is 64-bit.
Empty value (nothing is passed)if the system is 32-bit. Example UA: Mozilla / 5.0 (Windows NT 6.1; rv: 60.0) Gecko / 20100101 Firefox / 60.0
WOW64 - this value is transmitted when a 32-bit browser application is running on a 64-bit system.
<Firefoxversion> - this value shows the version of your Firefox browser. Note: the value is transmitted with only one digit after the dot, even if the browser version is "63.0.3", then only "63.0" will be transmitted to UA. Here is a link for a list of all current Firefox versions: https://www.mozilla.org/en-US/firefox/releases/
By combining these values, we get different UserAgent's. Do not forget that the values "rv:" and "Firefox /" are required must match.
Examples: Mozilla / 5.0 (Windows NT 10.0; Win64; x64; rv: 64.0) Gecko / 20100101 Firefox / 64.0 –UserAgent Windows 10 [64bit] with browser Firefox 64.
Mozilla / 5.0 (WindowsNT6.1; rv: 52.0) Gecko / 20100101 Firefox / 52.0 0 –UserAgentWindows7 [32 bit] with browser Firefox version 52.0.1 or 52.0.2
Mozilla / 5.0 (WindowsNT6.1; WOW64; rv: 43.0) Gecko / 20100101 Firefox / 43.0 –UserAgentWindows7 [64 bit] with browser Firefox, which is calculated as a 32-bit system version 43.0.1, or 43.0.2, or 43.0.3, or 43.0.4
Go to the Google Chrome browser.
UserAgent Google Chrome framework:
Mozilla / 5.0 (<Windows version>; <bit tags>) AppleWebKit / 537.36 (KHTML, like Gecko) Chrome / <Chromeversion> Safari / 537.36
Despite the fact that UAChrome seems to be more complicated, in fact it is even a little simpler. Chrome versions do not need to be duplicated twice.
<Windowsversion> and <bittags> are exactly the same values as in Firefox.
<Chromeversion> - this value shows the version of your Chrome browser. Here is a link for a list of current versions of Chrome: https://filehippo.com/download_google_chrome/history/
Example : Chrome / 71.0.3578.98
71.0.3578 is the browser version.
98 - Build. It shows how many fixes of various bugs, improvements were in this version.
Examples:
Mozilla/5.0 (WindowsNT6.3; Win64; x64) AppleWebKit/537.36 (KHTML, likeGecko) Chrome/71.0.3578.98 Safari/537.36–UserAgentWindows8.1 [64 bit] с браузеромGoogleChrome версии 71.0.3578 с build98.
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.110 Safari/537.36–UserAgentWindows 10[64 bit] сбраузеромGoogle Chrome версии70.0.3538сbuild 110.
Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.110 Safari/537.36 36–UserAgentWindows 10[32bit] сбраузеромGoogle Chrome версии70.0.3538сbuild 110.
Переходим к Opera.
Mozilla/5.0 (<Windows version>;<bit tags>) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/<Chromeversion>Safari/537.36 OPR/<Operaversion>
The Opera browser is implemented on the WebKit engine and V8 in the Chromium shell, so there is “Chrome / <Chromeversion>” in the UA, we can say that UserAgent is not very different.
<Windowsversion> and <bittags> and <Chromeversion> are absolutely all the same as I described above. The only moment with chrome versions, but more on that below.
<Operaversion> - this value shows the version of your Opera browser. Here is a link to the list of current versions of Opera: https://blogs.opera.com/desktop/
We are interested mostly in "Stable update", "beta update, developer update, initial release" -in to a lesser extent.
Example: OPR / 56.0.3051.116
56.0 – browser version
3051 – Build browser
116 – Patch browser.
I will clarify what is the peculiarity of Chrome. A specific version of Opera has a specific version of Chrome. You can't write a version of Chrome from the bulldozer, or vice versa. These two values must be consistent.
Here is a table, I threw in 11 versions of the Opera browser as examples.
https://docs.google.com/spreadsheets/d/1OglvdCpkWxr0GztpQ3Nzi3Ij0Ep4oEZxdfZn-PVwdqU/edit?usp=sharing
Examples:
Mozilla / 5.0 (WindowsNT10.0; Win64; x64o, Apple.3Web6GeHT5.0ck) Safari / 537.36 OPR / 55.0.2994.44 -UserAgentWindows10 [64 bit] with Operator version 55.0
Mozilla / 5.0 (Windows NT 6.2; WOW64) AppleWebKit / 537.36 (KHTML, like Gecko) Chrome / 68.0.3440.106 Safari / 537.36 OPR.4 / 55.0.2 UserAgentWindows 8 [64bit] with Opera32-Bit version 55.0
We turn to the Edge browser.
UserAgentEdge structure:
Mozilla / 5.0 (Windows NT 10.0; <bit tags>) AppleWebKit / 537.36 (KHTML, like Gecko) Chrome / <Chromeversion> Safari / 537.36 Edge / <Edgeversion>
<bittags> and <Chromeversion> are exactly the same as me wrote above
< Edgeversion > - this value shows the version of your Edge browser. Just like Opera, a certain version of Edge has a certain version of Chrome.
Here is a link to the current Edge versions: https://en.wikipedia.org/wiki/Microsoft_Edge
Note: We need the values "EdgeHTML version" and not "Version"
Example: Edge / 17.17134
17 - EdgeHTML Version
17134 - Window Build.
Table with examples of EdgeChrome versions
https://docs.google.com/spreadsheets/d/1QkUj5f0oPIUGU6aGyZSS9DNUpGCaywv9W50y-tvSVPM/edit?usp=sharing
Examples:
Mozilla / 5.0 (WindowsNT10.0; Win64; x64) AppleWebKit / 537.36 (likeG40.1 Safari / 537.36 Edge / 17.17134 -UserAgentWindows10 [64 bit] with Edge browser version 17.
Mozilla / 5.0 (Windows NT 10.0) AppleWebKit / 537.36 (KHTML, like Gecko) Chrome / 64.0.3282.140Safari / 537.36 Edge / 17.17134-UserAgentWindows 10 [32 bit] with Edge browser 17.
To conclude on this topic UA, there is still a lot to say about existing UAs, since I have analyzed only the most basic browsers and the most popular and simple options. If at all this article goes, then I will reveal in more detail about more complex variations of UserAgent from different types of browser; about mobile UserAgent new types of browsers.
Other options where you can get UA:
1) Real devices.
2) https://developers.whatismybrowser.com/useragents/explore/ Many different UAs by browser type, by OC, mobile UA, etc. There are a lot of sampling options. The disadvantages are that there is a lot of any "slag", there are not so many newer versions; there is a parameter of UA popularity, but I would not advise you to focus on it.
3) Configshop. Actually, in the config shops, you can safely see this parameter without buying a config. The option is very convenient, because you can make a selection according to the necessary parameters and the most relevant UAs in the config shops. In some, you can simply register easily. I will not throw links here, who will really need it - write in the LAN or by contact.
Let's go through the simple config settings in LinkenSphere (Extendedsessionsettings).
Navigator.vendor - This parameter displays the name of the browser vendor. In our browser types, the Value is empty, or "Google Inc." The parameter is static, i.e. does not change. Values in our browser types:
Firefox - empty
Edge - empty
Chrome - GoogleInc.
Opera - Google Inc. [/ QUOTE]
Navigator.ProductSub - This parameter shows the Build browser number. The parameter is static, i.e. does not change. Values in our browser types:
Firefox - 20100101
Edge - 20030107
Chrome - 20030107
Opera - 20030107
Navigator.hardwareConcurrency- this parameter shows the number of processor threads, and not the number of physical processor cores, as many believe. The parameter does not depend on the type of browsers we are considering. Popular values for this parameter: "2", "4", "8", "12".
For a better understanding, I will consider a new processor on laptops: IntelCorei7-8750H. This is a 6-core processor, but it has 12 threads, therefore the parameter will be set to "12" and not "6". Sometimes the number of threads matches the number of cores. By the name of the processor, you can always look at these values on the Internet. As for the information in the logs, there is just information about the number of threads, so you can safely set this parameter, but just in case, double-check (parameters: # of Cores and # of Threads)
Navigator.MaxTouchPoints- this parameter shows the maximum number of simultaneous touch presses that the device supports, i.e. if the device has several touch screens with different maximum values, the maximum value is shown. The parameter does not depend on the type of browsers we are considering. In general, they usually say that this parameter is more relevant for mobile configs and this is true, but not quite.
An ordinary stationary computer or laptop with a connected mouse and keyboard will show the value "0". Most often, this is the value of the parameter.
But there are touch monitors in laptops, touch monitors for stationary PCs. Therefore, in this case, the parameter value is usually "1" or "2". Therefore, when setting up our types of config, it is permissible to set these values.
According to the information from the log, it is not possible to determine in 95% which particular laptop or which display, so it is better to set the default value "0".
Navigator.Platform - this parameter shows the platform on which the browser is running. Within our browser types and OS, there can be two values: "Win32" and "Win64". But even if Windows64-bit and the browser software are 64bit, the value "Win32" is still used. Therefore, we set only this value.
Navigator.doNotTrack - this technology allows you to enable or disable the ban on tracking by sites, various systems. The most popular values used are: "Null" - the user did not set this parameter, therefore, it is not enabled. This is the most commonly used parameter. "1", "true" - the user has enabled this function, "0",
"False" - the user has disabled this function. All three values can be used in configs, preferably "null" or "0".
Regarding substitution without antidetects, Google has pictures with instructions for each type of browser how to enable / disable this technology
Navigator.gamepads - this technology shows the connected gamepads and their properties (joysticks like on Xbox and Playstation). By values in the sphere: "True" - the function is enabled, "False" - the function is disabled.
Feature: Even if there are no gamepads connected to the system, this function is enabled. So basically we use the T "rue" value for our browser types regardless of the OC version. Even on most mobile browsers, the Navigator function is also
enabled.battery- this technology shows information about the state of the battery (whether charging is in progress, the level of charging in%, the amount of time to fully charge / discharge, etc.). According to the values in LinkenSphere: "True" - this function is used without substitution, "False", "Fake" - is identical to True, only the parameters of the battery itself are substituted.
By use: in Edge, Firefox (after version 52) set only "False", in Chrome and Opera set either "true" or "fake".
This feature, as one might think, applies not only to laptops. On desktop computers, the Battery function is enabled. The difference is that the parameters will be static, as if it were a laptop on a charge at 100%
Information on how to configure this parameter from the log: if you have determined that the PC user can enable "fake" from a laptop, but if your system, where LinkenSphere is installed, has static Battery parameters and the log user has a stationary computer, then it makes sense to enable "True".
On real systems, if you have a laptop, it is very easy to change this parameter, you just need to discharge / charge the battery. Then the values of this function will change.
Navigator.webdriver.Webdriverin a browser, it is a software library (driver) that allows other programs to interact with the browser; manage your browser. This technology appeared in the browser not so long ago, therefore it is experimental, there is not much information on it already. The webdriver technology is supported by all major types of the latest browsers. The main values of the Webdriver property are "true", "false", and "undefined" (undefined). On use in LinkenSphere: if we make configs of older versions of the browser (below 63 Chrome and 50Opera, then use the value "undefined"). In other cases, the values "true" and "false" are allowed. But taking into account the specifics of this technology and how it is implemented in browsers, I advise you to use "false" in 95% of cases.
Navigator.Online- this parameter shows the status of the browser. Parameter options: "True", "False", "1", "0". Here and a no brainer that the value should be "True" or "1". In the sphere, the ability to set only these parameters has been specially established.
Navigator.deviceMemory - This parameter shows the amount of RAM in GB. Values: 0.25 to 256 MB of RAM, 0.5 to 512 MB, 1 to 1024 MB, etc. to a value of 8. If the RAM is more than 8 GB (12 GB, 16 GB, 32 GB, 64 GB), then the value will still be "8". If you configure the Firefox browser config, then set the value "False", i.e. To. there is no given
Contact author: Jabber: wirl@exploit.imIf you configure the config of Chrome, Edge, Opera, then set this parameter (Works in Chrome with version 63, Opera50 and Edge17 version). The most popular values are "2", "4", "8".
ncognito -parameter shows whether incognito mode (private mode) is enabled or disabled in the browser. For work, set only "False".
Incognito mode in the browser is when the browsing history, cookies, autocomplete, etc. are not saved. An excellent option for schoolchildren to watch porn so that the mother or father burns))
Setting the language in the config
Three parameters are responsible for the language in the config in antidetects. Two navigator (language, languages) one in browser headers (HTTP_ACCEPT_LANGUAGE)
Navigator.language- this parameter shows the language of the browser interface (that is, roughly speaking, which language of your browser, and not the system, this will be displayed in this parameter.) Example: "en-US", "en-GB", "ru-RU" " etc. This parameter is composed as follows:
[Name of Language] - [Country codes]
NameofLanguage - below is a link to a list of all languages and designations: http://www.loc.gov/standards/iso639-2/php/code_list.php(select value from "ISO 639-1 Code")
Countrycodes - below is a link to a list of all languages and designations:
https://www.iso.org/obp/ui/#search/code/ (take value from "Alpha-2code")
Navigator .languages - this parameter shows the preferred languages of the user and is taken from HTTP_ACCEPT_LANGUAGE
Example: "en-US, en, ru-RU, ru", "de-DE, de, en-US, en"
The parameter is composed like this for EACH language (each language is separated by a comma without a space):
[Name of Language] - [Country codes], [Name of Language]
HTTP_ACCEPT_LANGUAGE - this parameter shows the preferred languages that the user can understand (system language, browser interface language) and the "preference" of the language.
Example: "ru-RU, ru; q = 0.9, en-US, en; q = 0.7"
The parameter is composed like this for EACH language (each language is separated by commas without a space):
[Name of Language] - [Country codes], [Name of Language]; q = [quality values]
qualityvalues- the meaning of the "preference" of the language. It can range from 0.1 to 0.9. The higher, the preferable the language. I advise you to set for the main language from 0.6 to 0.9, for the second from 0.4 to 0.7.
In the sphere, to configure the language parameters, you just need to configure HTTP_ACCEPT_LANGUAGE
Contact the author: Jabber: wirl@exploit.im ( https://prnt.sc/lypoyp ). The easiest way to change the language without HELL is just to change the language in your browser. The log also contains information about the user's language and the languages of the keyboard layout.
Configuring Screen Parameters
Move on to the parameter settings that relate to the user's system screen. I will not go into theory too much, I will try to explain these parameters very simply in practice.
First, let's see the main screen parameters in LinkenSphere, clearly in the screenshot:
http://prntscr.com/lz6cwt
Screen.width | device-width - these parameters show the screen width in pixels. Of course, in some subtleties, these are different parameters, but within the framework of our article I combined them, since the values will be the same.
Screen.height | device-height - these parameters show the height of the screen in pixels. Combined for the same reason .device-width and device-height in the scope to customize in the general settings (Physicalscreensize).
Screen.width and Screen.height adjust in the session screen setting (NOT in Extendedsettings)
Screen.availWidth- this parameter shows the width of the screen in pixels that the browser can occupy. In the screenshot, we have the taskbar at the bottom, therefore, it is associated not with the width, but with the height; the browser may take full length. Therefore Screen.availWidth = Screen.width | device-width
Screen.availHeight - this parameter shows the screen height in pixels that the browser can occupy. In the screenshot, in order for the browser to occupy the full height, the taskbar "interferes", so this parameter will be calculated as Screen.widthMINUS taskbar height.
Let's look at the examples from the first part of the article, when we looked at the taskbar there.
Now in even more detail and with an example. Let's take a FullHD1920x1080 screen. If the default taskbar (at the bottom, with large icons as in the screenshot), then its height will be 40px. With these values, "Screen.availWidth" will be 1920, and "Screen.availHeight" will be 1040px (1080-40 = 1040)
If the icons in the taskbar are small, the taskbar height will be 30 px, and the “Screen.availHeight” value will be 1050px
If the taskbar is hidden, the "Screen.availHeight" value will be 1080px.
The story will be exactly the same if the taskbar is located not at the bottom, but at the top.
Further, the taskbar can be placed to the right or to the left, and then the "Screen.availWidth" parameter will change. By default it will be 1858 (1920 MINUS taskbar width 62px). If the icons are small, then with this arrangement of the taskbar nothing changes in the width of the panel, and the value will be 1858; if the taskbar is hidden, then the value will be 1920.
That's why we looked at the taskbar from the screenshot in the log.
Screen.availTop - shows the first top (vertical) pixel screen coordinate that is not occupied by the taskbar.
Screen.availLeft - Shows the first top (horizontal) pixel screen coordinate that is not occupied by the taskbar.
If the taskbar is located at the bottom or on the right, these parameters will have a value of "0". Exception: if there is a second monitor, then the "Screen.availLeft" parameter can be negative or even positive.
If the taskbar is located at the top or on the left, then these parameters will have values depending on whether the icons are large or small. If the taskbar is hidden at the same time, then these parameters will have the value "0".
Otherwise: if the taskbar is on the left by default, then "Screen.availLeft" will have a value of 62px, if the taskbar icons are small, then also 62px (since when it is placed sideways, the width does not change)
If the taskbar is at the top, then " Screen.availLeft ”will have a value of 40px, if the taskbar icons are small, the value will be 30px.
Simply put, Screen.availTop shows the height of the taskbar if it is at the top, Screen.availLeft shows the width of the taskbar if it is on the left.
Knowing the location of the taskbar about the screenshot of the screen in the log, we can calculate these parameters.
The above values are valid for a FullHD screen of 1920px by 1080px.
In the attachments of the theme (at the very bottom), I attached the simplest, but very convenient checker for calculating the parameters of the screen and browser window. I am not a programmer and I am not fond of this, so the checker works correctly and stably only on Chromium browsers (Chrome, Opera). Therefore, you should not use this checker on Firefox. I hope there is someone who knows jQuery and adapts this simple checker for Firefox as well.
As a bonus, a link to a table where I indicated the most popular screen resolutions for OC and calculated the parameters for different browser resolutions:
https://docs.google.com/spreadsheets/d/12KM12QLMdwdmBKDuxlM-uh31WZNMQ6hdlIz_QnipAVg/edit?usp=sharingand
Screen.colorpthixthix - these parameters show the quality of color reproduction. The values of these parameters are the same. Possible values are "24" and "32". Within the framework of our article, we put only "24". The value "32" has such devices as Iphone, Ipad, etc.
Screen.orientation - this parameter displays information about the screen orientation. The easiest way to explain this is with a screenshot. https://prnt.sc/lz7j8w
We use only the landscape-primary parameter within the PC, the rest of the parameters are for mobile devices, tablets, etc.
Screen.angle - this parameter shows the screen rotation angle. "Landscape-primary" value0;
"Portrait-primary" value90; "Landscape-secondary" value
180 ; "portrait-secondary" value 270 First, let's see all the main parameters of the browser window in LinkenSphere clearly in the screenshot for better understanding (the screenshot was honestly stolen and modified): https://prnt.sc/lz7r9g
View the setting will be with two options:
1) Full-screen mode, when we expand the browser to full screen.
2) Windowed mode, when the browser occupies only some part of the screen. The screenshot shows just this option as an example.
The screenshot above demonstrates these parameters perfectly, and how they differ from others. If the browser is in full screen mode, the volumes can be specified with exact values. If we work in windowed mode, then there can be a huge variety of values, the main thing is that the values are "consistent" with other parameters (innerWidth, client.Width, innerHeight, clientHeight, screenLeft, screenTop, screenX, screenY). The best and easiest way to get values for windowed mode is to use the script that I attached to the theme.
In full screen mode, these parameters correspond to the parameters "availWidth" and "availHeight"
Window.innerWidth and body.clientWidth- these parameters show the value of the width of the working area of the browser, in other words, the entire width in pixels to which your sites are loaded, excluding the width of the scroll, the taskbar, if it is placed on the right, and other elements that narrow this width. I combined these parameters, since they will coincide within the framework of our article.
Window.innerHeight and body.clientHeight - these parameters show the height of the browser's working area, in other words, the entire height in pixels to which your sites are loaded, excluding the horizontal scroll height, the height of the tab area, the height of the URL line in the browser and other elements that reduce this width ... I combined these parameters, since they will coincide within the framework of our article.
These parameters are the most dynamic and unpredictable in comparison with other parameters. Even in fullscreen mode, besides outer.Width / Height, a bunch of other windows are affected.
For example, in GoogleChrome, the setting of the browser appearance settings ("Show bookmarks bar") affects whether the downloaded files bar is displayed in the browser (Example: http://prntscr.com/lzd3r5), etc.
In Firefox, the settings in the "Customize" section affect ( https://support.mozilla.org/en-US/k...e=en-US&redirectslug=Navigation+Toolbar+items). Specifically, the Toolbars (Menu, Tab, Title) parameters, the "Density" parameter.
And so in each browser, different settings affect these values.
In windowed mode, in addition to these parameters, the parameters “screenLeft, screenTop, screenX, screenY, outerWidth / Heght) also affect.
In any mode, the devicePixelRatio parameter affects, but more on it below. Again, the best and easiest way to get the values is to use a script.
In the table I will give setting options for different screen resolutions in full screen mode with default browser settings.
https://docs.google.com/spreadsheets/d/12KM12QLMdwdmBKDuxlM-uh31WZNMQ6hdlIz_QnipAVg/edit?usp=sharing
window.dexicePixelRatio- this parameter shows the ratio of the size of the physical pixel to the logical one. In simple terms, as far as our browser types are concerned, it is the page scale parameter. By default, it is 100% and the parameter is "1". If we increase the scale of the page or decrease it, then this parameter changes. We increased the page scale by 125%, the parameter changed to "1.25", reduced the page to 90%, the parameter changed to "0.9".
Clarifications : changes to this parameter affect the parameters “Window.innerWidth, body.clientWidth, Window.innerHeight, body.clientHeight) in full screen mode and in windowed mode.
To change the parameter naturally, you need to use the increment or decrement step as in a real browser. Example:
Firefox browser scale values: "50%", "60%", "70%", "80%", "90%", "100%", "110%", "120%", "130%", " 140% ”, etc. (10% step)
Browser Chrome scale values:“ 33% ”,“ 50% ”,“ 67% ”,“ 75% ”,“ 80% ”,“ 90% ”,“ 100 % "," 125% "," 150% "," 175% "," 200% "," 250% "," 250% ", etc. (Dynamic step).
And so for every browser.
One more subtlety with the values of this parameter. Let's take the Chrome browser:
100% -value of the parameter "1"; 110% the value of the parameter is not "1.1", but "1.100000023841858"; 125% value of the parameter "1.25". Those. the meaning may not always be exactly the same; in different browsers in different ways
The last subtlety: the size of the working window, decreases or increases NOT EXACTLY by the value of devicePixelRatio. Those. if we increase the scale by 25%, it does not mean that the height of the browser work area will decrease EXACTLY 25%. The percentage values will be different.
window.screenLeft and window.screenX - these parameters show in pixels how far the browser window in windowed mode is shifted to the right of the first pixel.
window.screenTop and window.screenY - these parameters show in pixels how much the browser window in windowed mode is shifted down from the first pixel
In the screenshot, I clearly showed these parameters. Combined these parameters, since they are the same within the framework of our article. All of these parameters are used in the browsers Chrome, Opera, Edge. Mozilla Firefox browsers use only these parameters: ScreenX and ScreenY.
If the browser is in full screen mode and the control panel is at the bottom or on the right, then these parameters are equal to "0".
If you use full screen mode in the browser and the control panel is on the left or on the top, then the values of these parameters are equal to the width or length of the control panel.
If the windowed mode of the browser is used, the parameters will depend on how far they are shifted from the left first pixel of the screen and the top first pixel of the screen. It is best to use a script to calculate these parameters. These parameters do not directly depend on the Outer.Width / Hegiht, innerWidthHeight parameters, i.e. the rule "Screen Width = screenLeft / screenX + Outer.Width" DOES NOT WORK, since there are no parameters responsible for the right and bottom sides of the screen, and, therefore, the value of "outer.Width" with a value of screenLeft / screenX 50px can be the same as 600 px Both 500 px and 900 px - it all depends on how much we "stretch" the browser window in width. This rule also applies to screen height.
window.pageXOffset- this parameter shows how much the page is scrolled to the right (vertically in pixels) using the scroll bar relative to the upper left window.
window.pageYOffset - this parameter shows how much the page is scrolled down (horizontally in pixels) using the scroll bar relative to the upper left window.
For a better understanding, see the screenshot.
In full screen mode, the window.pageYOffset parameter is dynamic, because on almost any large popular site, we scroll down the page, rarely when the site completely fits into the working window, the main page of google search does not count.Therefore
, it is best to simply NOT change this parameter.In full screen mode, the window.pageXOffset parameterfor the most part it is equal to "0", since sites are adapted to different screen resolutions, and side scrolling is wildly inconvenient. But if we have a windowed browser mode, then it can also be, depending on the site and the size of the browser window.
Therefore, it makes no sense to set constant values for these parameters. As for me, if we really take a substitution, then the only possible sense is to make it random within any values
Configuring plugins in the config
I described plugins in detail in section 1 of the article. In new versions of Chrome, Firefox, Opera, Edge, there are only built-in plugins and 1 plugin that can be installed -AdobeFlashPlayer. There are two types of AdobeFlashPlayer: AdobeFlashPlayer ** NPAPI - Firefox subbrowser. AdobeFlashPlayer ** PPAPI - Opera / Chrome subbrowser.
Now we'll take a closer look at how to customize plugins and what variations you can make.
Firefox has two built-in plugins by default "WidevineContentDecryptionModule" and "OpenH264 VideoCodecprovided", but these plugins are not shown when requested.
In Firefox, the only plugin you can add is Flash. Subtleties: when installing in the Flash system, the default setting is "AsktoActivate"; with this setting, Flash is shown only when the site is requested; the plug-in does not light up in the checkers; if the "AlwaysActivate" parameter is selected, then the physical Flash and the plugin are lit. Therefore, by installing Flash into the system, we can uniqueize this fingerprint without an antidetect.
With antidetect, we have two options: either we add a Flash plugin, or we don't. If we add, then we have different variations in the form of Flash versions. This gives us the ability in different configurations to make a different Flash plugin, and not add the same one. Below there will be a link to a table for the type of Firefox browser, how the Flash setting looks in the plugin, as well as a list of different versions. As a reminder, in the realm, plugins are configured in "Extendedsessionsettings".
https://docs.google.com/spreadsheets/d/1BPCD97WmsiSsHoFDZ3MJjtbbvtqBMgpJfXpF4SGnjc0/edit?usp=sharing
GoogleChrome has 4 plugins by default, some of them can be enabled / disabled; the only plugin that can be added is also Flash.
Plugin parameters are static by default; they don't change. The Flash plugin has the same parameters that change depending on the version of the plugin and depending on the bitness of the system: 32-bit; 64-bit. More about default plugins:
ChromePDFPlugin and ChromePDFViewer - these plugins are responsible for PDF documents in Chrome and allow, for example, to open PDF directly in Chrome online, without downloading the file to your computer. These plugins are linked; so you either add both plugins to the config, or neither. You can turn it on / off in a regular browser in Advanced settings -> Content settings -> PDF documents.
WidevineContentDecryptionModule- this plugin is responsible for prohibiting copying of audio and video content by the copyright holder. Since version 57 of Chrome, the plugin cannot be disabled. But at the same time, I have repeatedly seen in systems and configs that this plugin did not glow, although the versions of Chrome were one of the most recent.
Native Client - the plugin is responsible for launching some online games and applications. You cannot disable it, so this plugin is added 100%.
Here is a table for configuring plugins in the sphere for the type of Google Chrome browser and variations of settings with Flash:
https://docs.google.com/spreadsheets/d/1BPCD97WmsiSsHoFDZ3MJjtbbvtqBMgpJfXpF4SGnjc0/edit?usp=sharing
In the Opera browser, everything is identical.
1) The names of the plugins responsible for PDF are different. Instead of "ChromePDFPlugin" the value is "Chromium PDF Plugin"; instead of "Chrome PDF Viewer" value "ChromiumPDF Viewer".
2) There is no Native Client plugin.
3) Plugin "Newsfeedhandler". Responsible for feeds, i.e. for receiving content from the site directly into the browser using the RSS protocol. Activated by default. Therefore, we add this plugin
Here is a plate for configuring plugins in the sphere for the browser type Opera and variations with Flash:
https://docs.google.com/spreadsheets/d/1BPCD97WmsiSsHoFDZ3MJjtbbvtqBMgpJfXpF4SGnjc0/edit?usp=sharing
Setting the font list
All antidetects on the market allow you to replace the font imprint. The configs of most antidetects contain a list of fonts. The sphere allows you to conveniently edit the list of fonts in the config or create from scratch by loading font names from a file.
In the system itself, without an antidetect, you can very easily edit the list of fonts. To do this, go to the control panel -> design and personalization -> fonts.
There you can add new fonts after downloading them, delete existing fonts. By performing such manipulations, we change our list.
On each system, due to the installed various programs and other factors, the list of fonts and the number of fonts will be different. But there are basic fonts for every version of OCWindows.
List of base fonts and their styles for
Windows7https: //docs.microsoft.com/en-us/typography/fonts
/ windows_7_font_list List of base fonts and their styles for Windows8 https://docs.microsoft.com/en-us/typography/fonts
/ windows_8_font_list List of base fonts and their styles Windows10https: //docs.microsoft.com/en-us/typography/fonts
/ windows_10_font_list You can use
these base fonts as a starting point for your list. Some clarifications: all links of the font family are clickable. Inside you can find information about which Windows operating systems and programs use a given font family. You do not need to specify all font styles in the list, you can only specify the font family. Check the font families on the site; for example, the "Wingdings" family actually contains 3 fonts.
Here's a great list for building your font list. It lists a large number of fonts and which Windows operating systems and programs use them.
Configuring the substitution of WebRTC and.MediaDevices.enumerateDevices
.MediaDevices.enumerateDevices - this function allows you to get a list of all devices (audio and video devices of the system, USB cameras, microphones, etc.). You can get deviceID of device data, device name and device type.
The function in LinkenSphere has settings: "True" - the function is enabled, but the parameters are not overwritten. "False" - the function is disabled, "Fake" - the function is enabled; parameters are overridden.
In our types of browsers, we only use the "Fake" parameter.
Moving on to configuring WebRTC, we will use spoofing on all types of browsers, which we are discussing with you today. Let's consider some subtleties.
1) Checkbox IPv6... Enable this checkbox if your system is leaking ipv6. You can check it here: https://browserleaks.com/ip
(item "IPv6 Address") 2) External (Public) IP in WebRTC. Everything is simple here: the external IP matches the IP of your sock or tunnel. But when working with syllables, I also met such an unusual approach. Its essence lies in the fact that the external IP is set to the user's IP system. Yes, at the same time, checkers will show that it is wrong, but this approach takes place.
3) Internal (Local) IP in WebRTC. This is also kind of simple: there are local IP ranges that can be used.
10.0.0.0 —10.255.255.255
172.16.0.0 —172.31.255.255
192.168.0.0 —192.168.255.255
But again, there are subtleties. Let me remind you this plate:
https://docs.google.com/spreadsheets/d/1GySRwS_QAmvPSJEDxYcsGnz_7Vu_mtj0nn_RvY4wgl4/edit?usp=sharing
So, there is a Default Local IP column. This is the local IP router by default, by which you can just get into its settings. Therefore, it is better not to set these IPs when setting up the config.
The next trick is to work with logs and local IP. In the first part, we tried to find out the approximate brand of the router, and ideally its model. So in some cases, we can assume an approximate local IP address.
In general, where does this local address in WebRTC come from on your system? Most routers have a DHCH server in their settings. The DHCH server assigns a local IP to each device that connects to the router. Usually, the DHCH parameter settings are something like this, depending on the brand and model of the router: Start IP, End IP and the time for which the IP address is issued. Let's take, for example, that the router has the following settings:
Start IP: 192.168.0.2
End IP: 192.168.0.100
Time: 1440min (24 hours)
We connect our laptop to the router, the DHCH server gives it a local IP: 192.168.0.2 for 24 hours; We connect our mobile phone, the DHCH server gives it a local IP: 192.168.0.3 for 24 hours; we connect our refrigerator with Wi-Fi to the router, the DHCH server gives it a local IP: 192.168.0.4 for 24 hours, etc. Let's say 12 hours have passed, the lights were turned off, and the router rebooted; and the refrigerator was the first to connect to our router. Now the DHCH server gives him the local IP: 192.168.0.2 for 24 hours; then the mobile phone connected - the DHCH server gives it a local IP: 192.168.0.3 for 24 hours; then the laptop connected, the DHCH server gives it a local IP: 192.168.0.4 for 24 hours.
Thus, in this example, it can be seen that the local IP is a dynamic parameter and can vary within the limits specified in the DHCH server setting in the router.
Knowing the brand of the router and the approximate model, you can look at this IP range, and put the approximate local IP in the log. Again, in the example above, the owner has a D-Link router; we have defined the start and end IP. The owner, most likely, has 2-4 more devices in addition to the computer that are connected to the router (for example, a phone and a TV). Therefore, we can safely set the local IP "192.168.0.2" or "192.168.0.3" or "192.168.0.4" or "192.168.0.5". On the Internet, you can find emulators of most popular routers and see the base IP range in the settings; in the table I also added the initial and final IP to some models.
Configuring substitutions in the config.
Although this does not apply to setting up a real config, I will go through some of the features. You can find a bunch of different information about all the prints that the sphere replaces, so I will not describe the same thing 10 times
About the use of substitutions: I advise you to use all the substitutions in any of our browser types, but with some subtleties.
1) EnableFlash - enables Flash. Turning on flash unnecessarily is not recommended by every author of an antidetect, as this is an additional variation to detect you. As for the use of Flash, they can advise such options, it does not matter whether we create a config for working with a log or a config of any of the browser types:
A) Add Flash to the config plugins, but leave the physical flash (enableflash) disabled. Here we get an interesting situation, for plugins we have it as it is, but there is no physical version.
B) Add Flash to config plugins and enable physical flash (enableflash). I described the disadvantages of this option above.
One more point, in some antidetects you can configure Flash settings, so if there are such settings, and you decide to use Flash, be sure to remember to configure them (such parameters as OC, language, screen resolution, Flash version, etc.)
2) Canvas substitution. We enable this substitution, but now I will write options when you can try to disable this substitution in our browser types.
There are only two of them: A) When the created config has the same browser type as the antidetect, i.e. LinkenSphere is written on the basis of Chromium, therefore, if you create a Chrome configuration, it is allowed to disable spoofing as an option. The second option is a little worse: this is when the browser is made in the Chromium shell. In our case, this is the browser type: Opera.
3) Substitution of AudioFingerprint. Substitution of course must be enabled. But audio also has parameters ( http://prntscr.com/lyqeto). Some of them can be changed in the system, so below there will be information for thought: as an option, in addition to the print, they can also be replaced. For example, the first parameter on the screen (ac-sampleRate) is very easy to change: for this you need to change the DefaultFormat (https://prnt.sc/lyqgop)
Tips, Tips, life hacks using the Linken Sphere antidetect and when working with logs.
1. Installing LinkenSphere: Virtual Machine or Base?
Should I install on a Virtual Machine or on a Basic Machine? Also a very popular question. Again, you can find the best option for you. LinkenSphere on the Main Machine
Pros:
1) Convenience of work
2) Does not require large resources of RAM, less load on the computer compared to using a virtual machine, for example, on Win10 x64, especially if the paging file is disabled for security and the PC is not very powerful.
3) If suddenly there is some kind of detection or detection of a virtual machine in the world that no one knows about yet, then this will undoubtedly be a plus compared to using an antidetect on a virtual machine. Let me explain in more detail what I had in mind: Almost any antidetect in the world, if it does not replace any parameter, then it is most likely taken from your system, or simply disabled.
4) Security. I do not presume to say 100%, but from a security point of view, in the chain of anonymity, perhaps this option is worse than using
LinkenSphere on a Virtual Machine or a server. LinkenSphere on a Virtual Machine. Here it is still the other way around, and the minuses become a plus, and the pluses become minuses.
3 use case: some people use LinkenSphere on a dedicated server, which is also an interesting option in its own way, which has some advantages from those two options above.
2. What type of configs is better to use for driving. "Good" options for using configs for different types of OS.
Actually, given that this Antidetect is written on the source code of the Chromuim engine, it is ideal to use configurations with the Chrome browser and browsers based on the Chromium platform.
If LinkenSphere is on your OCWindows, then "good" configuration options are:
1) Win XP, 7.8, 10 + Chrome
2) Win XP, 7.8, 10 + Opera
3) MAC OS + Chrome
4) Win10 + Edge ( Most recently, Microsoft announced the replacement of the engine with Chromium)
Mobile options:
1) Android + Chrome
2) Windows Phone + IE (Internet Explorer )
3) Iphone, Ipad + ChromeEsli LinkenSpherestoit you to OCMACX, the "good" config options:
- the MAC OS + the Chrome
- the MAC OS + the Safari
- Win + ChromeMobilnye options:
- Iphone, Ipad + Chrome
- Iphone, Ipad + Safari
Of course, you can use any config of any OS, but these are preferable due to the fact that the OS and / or platforms are the same.
3. Life hack: Using "Non-standard" configs when driving
As a good and unusual alternative to those variations that I wrote above, there can be the use of "non-standard" configs. In my understanding, non-standard configs are those systems that are not common in general and that are rarely used for driving. For the sphere and some other blood pressure, the criterion may still be that these configs cannot be found in the configshop. I will give examples of such configs: XboxOne, PlayStation4, Blackberry, PlayBook, Kindle, etc. It is difficult, of course, to imagine holders driving from Playstation4 or PlayBook, but nevertheless, these options take place in some topics and as one of the factors of "non-standard" driving ...
How to get these configs for a sphere? There is only one option - to do it yourself. After reading the entire manual, it will be more or less clear to you how to make configs. The only problem is, where can I get all the data (UserAgent, WebGL, WebRTC, Window.Screen, Window.Navigator, etc.) for these devices? Everything is very simple here) Either look at a real device for all the necessary checkers, or take it from the configs of another antidetect.
4. Using the "WebEmulator" tool
WebEmulator is a tool in LinkenSphere that allows you to automatically visit a list of sites, mimicking human behavior. This tool is useful in that it automates the process of receiving cookies, thereby reducing our time spent on routine work, i.e. you enter a list of sites, turn on the emulator, and wow, we already have a browser for cookies of various sites.
In practice, this tool is very useful, because shop antifraud systems may well collect and analyze your cookies. Thus, using this tool correctly, we will be more like an ordinary user.
According to the settings of this tool (Screenshot: https://prnt.sc/jkvy3p)
We put a check mark on Disablepopups (disable pop-ups) and Enablealertaftercomplete (Enable notifications after WebEmulator exits). MaxVisitedPage is how many maximum pages on each site will be open. Here, everyone decides how much to bet, I would recommend from 3-4 to 12-30. Maxtimeonpage, min - I would recommend setting from 30 seconds to 2 minutes.
Startdelay - this item is responsible for the delay (in minutes) before starting to turn on the emulator itself. It's up to you.
Each site must be specified on a new line and with httpS: //.
About the list of sites. I would recommend everyone to make their own list of sites to bypass, depending on the country of your drive (in my case, this is USA). In my list, I would have collected about 30-40 such sites, in order to be able to alternate between different sites, and not every time to bypass the same ones. For example, TOP sites by ALEXARANK: (https://www.alexa.com/topsites). There you can select the TOP 500 sites for different countries, find out the average depth of page viewing, the average duration of users' stay on the site for the last 3 months.
5. DetectSocialMediaLogin
http://www.tomanthony.co.uk/tools/detect-social-network-logins/
Here is a typical public example of a demonstration that sites can easily see if you are logged into popular social services. Therefore, in order to be more like a real user's PC, you need to create accounts in popular networks and log in to them immediately before your work (well, or buy ready-made accounts). The most popular services: Facebook, Twitter, Gmail, Youtube, Google+, Instagram, Pinterest, Battle Net, Xbox, PSN, Tumblr, etc.
This rule also applies to logs. We look in the accounts, what popular social services our user has, log in to them (if we do not automatically get it with the help of our cookies) and only then go to the sites we need.
Now let's move on to working with logs.
By all parameters, all logs can be divided according to the degree of importance (in descending order of importance):
1. A log that has a set of standard services complete with BA and cryptocurrency exchanges.
2. Log, which has a set of standard services such as Paypal, Amazon, various shops
3. Log, which has a couple of services / not interesting small shops; The cookies for this log are not particularly admirable for us.
4. Useless log
For beginners, first of all, there will be advice not to disdain category 2 and 3 logs, treat them with the same seriousness as logs in the first category in order to gain experience, get your hand, technically learn how to use the log and the chosen a tool for processing it.
On the forums, spent logs of different categories are often distributed; this option is also a good way to start working with logs.
You can determine the degree of importance by the Logins / Passwords of the log, auto-fill, and sometimes even by the splash screen on the desktop, you can distinguish the log of a schoolboy from a good log. With experience, depending on your skills, financial situation, you yourself will determine once or twice with which log to work painstakingly, with which not very much, and which one should be thrown out and not wasted your time. Working out logs in Linken Sphere is very convenient because, using different tabs, you can process several logs at the same time, which also saves time. Log processing can be complex, or processing for one specific request. It often happens that newbies work out logs for only 1 request, for example, on Paypal, and if they can't work out, they get upset and throw out the log. This is a bad way of working because with it you will not get a normal profit and knowledge; if you have a lot of time and little experience, work out the log to the fullest, fill your hand. Let's move on to interesting tips and life hacks when working with logs.
1. Determine your "attack vector". Simply put, you need to understand where the holder has money, what means of payment he uses most often. You can view the popular payment methods of the holder in Amazon, Paypal, Ebay, etc.). After you have determined where the money is, you need to try to find out how much money is kept by the holder, if possible. To do this, you need to get into online banking, look at statemans, etc.
2. Operator services such as AT&T, Verizon and others may have the function of blocking a SIM card, losing a phone and other useful things that can complicate the restoration of the holder's access, or even complete loss.
3. Always put messages from unwanted services and shops from which messages may come in the mail of the holder in the spam filters. Redirect the necessary messages through filters to your mail.
4. Check all cloud storages (Googledrive, icloud, onedrive, dropbox, etc.) There are great chances for PhotoID, DriveLicense, CreditCards, WalletSeed, 2FA and other useful information.
5. Live the life of a holder. After collecting all the information on the holder, read it on Facebook and other social media. networks, look where he is going tomorrow, when he is not at home, when he is in the hall, when he eats, with whom he fucks, this will help to compose a psychological portrait for psychological influence, as well as give the opportunity to choose the best attack time
For example, you can urgently call holder to work, send a wreath with threats
6. Leave behind backdoors. Put your secret questions on mails, link up your 2FA, phones, backup mails. Then, with a high probability, the holder will not be able to quickly and painlessly return his account, and even if he does, he may not notice your backdoor, which you can use again.
7. Passwords. Many holders use the same passwords, therefore, even if the required service is not in the log, you can choose it yourself by brute-force
8. Activity. By letters in the mail, you can determine the most popular and freshest by date services that the holder uses. From them choose the right ones - those that you know how to work out. These services will be more fraud-loyal, since the holder often uses them, and, therefore, they have more recent cookies compared to other services.
