Technique taxonomy
Which class of technique addresses which detection layer, and roughly what it costs an attacker. “Proven against” links to vendors we ourselves defeated with that class in our own tests. This is a taxonomy, not an exploit kit — no ready-to-run code.
| Class | Defeats | Tooling | Difficulty | Proven against (our tests) |
|---|---|---|---|---|
| Network identity | IP-reputation / ASN scoring | residential & mobile proxies | low | Cloudflare Bot Fight Mode |
| TLS / HTTP fingerprint | handshake mismatch (JA3/JA4, HTTP/2 frame order) | fingerprint-matching clients | medium | — |
| Browser hardening | headless/automation tells (navigator.webdriver, CDP) | hardened Chromium builds | medium | Fingerprint (FingerprintJS), Google reCAPTCHA (v3 / Enterprise), Cloudflare Turnstile, hCaptcha |
| Behavioral simulation | behavioral scoring (mouse, dwell, scroll) | input-synthesis frameworks | high | — |
| Challenge handling | the CAPTCHA layer | solver services, human-in-the-loop | medium | — |
| Client interrogation replay | active environment probes (Kasada-style) | reverse-engineered sensor payloads | very-high | — |
We publish the taxonomy and the cost curve — which class beats which vendor, and roughly what it costs the attacker — not weaponized, ready-to-run bypasses.