Intoxicus

Unlox

GTXJackBauer
A EVGATech posted this in another thread.

I honestly don't believe anything Newegg says. LOL

oof, if I have some free time later I may make a video to show how fast even a terrible low-level bot can run through a checkout process and bypass simple checkbox bot protection.

please do

q5sys

Unlox
Well here is a selenium based bot I whipped up in real-time using reCAPTCHA like nothing and working through a fake EVGA order in about 28 seconds or less. Proper bots using optimized code and not Selenium can get this entire process down significantly faster and is only limited by the HTTP response rate.
 
This was to show how CAPTCHA and reCAPTCHA when setup in a single-use case can not detect even dead simple bots like this and why the entire internet sold out in less than a minute. Multiple CAPTCHA and reCAPTCHA instances in a cascading setup would provide more chances for the bot to encounter a challenge image. Other solutions would also provide more time for real users.
 
www.youtube.com/watch?v=cR2Pmf2CWTA

Selenium isn't really a bot though, it's just a way to test UIs.  Yea it can be used to automate things... which is kind of its purpose, but it's not really a bot in the way I think most of us are talking about.  Directly interfacing with API calls would be what I've been referring to, because that does away with the need of having any web browser action at all. 
With Selenium or other UI testers, anyone can pull that off.  There are even browser plugins where you record action and then it'll reply it on demand, all you'd need to do is go in and change the initial link and you'd be good.  But that wont work if the site is overwhelmed and web hosting is being redirected... API calls usually still work in those situations... assuming they're working on a different port.

q5sys

Unlox
 
The main point of that was that CAPTCHA/reCAPTCHA failed. Also while selenium to a normal user is basic, it has integration with python where a proper powerful bot can be made. If CAPTCHA cant detect a simple selenium solution then more advanced proper bots can easily shake the initial checkbox solution.
 
www.selenium-python.readthedocs.io/

Understood.  Also... Obligatory post... https://www.youtube.com/watch?v=fsF7enQY8uI

{
  "id": "49a4d828-46e5-4cf0-b00b-4b95bfa768e6",
  "version": "2.0",
  "name": "evga",
  "url": "https://www.evga.com/products/product.aspx?pn=08G-P4-3065-KR",
  "tests": [{
    "id": "52733568-b31b-41a2-8991-4a999a5ef456",
    "name": "evga bot",
    "commands": [{
      "id": "3d7c6c77-daaf-4b16-9c2c-3c3372fab83d",
      "comment": "",
      "command": "open",
      "target": "https://www.evga.com/products/product.aspx?pn=08G-P4-3065-KR",
      "targets": [],
      "value": ""
    }, {
      "id": "6e6a1fc2-24e2-41b5-b054-6aa3103851da",
      "comment": "",
      "command": "setWindowSize",
      "target": "1936x1056",
      "targets": [],
      "value": ""
    }, {
      "id": "5eeefa0d-2bab-48ce-8d21-ffce8671d834",
      "comment": "",
      "command": "click",
      "target": "css=.AddToChat",
      "targets": [
        ["css=.AddToChat", "css:finder"],
        ["xpath=//a[@id='LFrame_btnAddToCart']/span", "xpath:idRelative"],
        ["xpath=//div/a/span", "xpath:position"],
        ["xpath=//span[contains(.,'ADD TO CART')]", "xpath:innerText"]
      ],
      "value": ""
    }, {
      "id": "5346897f-2467-4d93-a431-5a97cb5910cf",
      "comment": "",
      "command": "click",
      "target": "id=LFrame_CheckoutButton",
      "targets": [
        ["id=LFrame_CheckoutButton", "id"],
        ["name=ctl00$LFrame$CheckoutButton", "name"],
        ["css=#LFrame_CheckoutButton", "css:finder"],
        ["xpath=//input[@id='LFrame_CheckoutButton']", "xpath:attributes"],
        ["xpath=//div[@id='LFrame_pnlMain']/div[2]/input[3]", "xpath:idRelative"],
        ["xpath=//div[2]/input[3]", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "62f04179-13f5-4619-b4c5-37c229753ab3",
      "comment": "",
      "command": "click",
      "target": "id=evga_login",
      "targets": [
        ["id=evga_login", "id"],
        ["name=evga_login", "name"],
        ["css=#evga_login", "css:finder"],
        ["xpath=//input[@id='evga_login']", "xpath:attributes"],
        ["xpath=//div[@id='EVGAContent']/div/div/div/div/form/div/div/table/tbody/tr/td[2]/input", "xpath:idRelative"],
        ["xpath=//td[2]/input", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "bbc4232b-6a14-40b2-86a8-e791c1cd2b37",
      "comment": "",
      "command": "click",
      "target": "id=evga_login",
      "targets": [
        ["id=evga_login", "id"],
        ["name=evga_login", "name"],
        ["css=#evga_login", "css:finder"],
        ["xpath=//input[@id='evga_login']", "xpath:attributes"],
        ["xpath=//div[@id='EVGAContent']/div/div/div/div/form/div/div/table/tbody/tr/td[2]/input", "xpath:idRelative"],
        ["xpath=//td[2]/input", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "8c0be8b4-a342-4370-ba84-26e0fb8f6f3e",
      "comment": "",
      "command": "doubleClick",
      "target": "id=evga_login",
      "targets": [
        ["id=evga_login", "id"],
        ["name=evga_login", "name"],
        ["css=#evga_login", "css:finder"],
        ["xpath=//input[@id='evga_login']", "xpath:attributes"],
        ["xpath=//div[@id='EVGAContent']/div/div/div/div/form/div/div/table/tbody/tr/td[2]/input", "xpath:idRelative"],
        ["xpath=//td[2]/input", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "a80e98a3-9761-4a0d-b052-51b7f2380755",
      "comment": "",
      "command": "click",
      "target": "id=evga_login",
      "targets": [
        ["id=evga_login", "id"],
        ["name=evga_login", "name"],
        ["css=#evga_login", "css:finder"],
        ["xpath=//input[@id='evga_login']", "xpath:attributes"],
        ["xpath=//div[@id='EVGAContent']/div/div/div/div/form/div/div/table/tbody/tr/td[2]/input", "xpath:idRelative"],
        ["xpath=//td[2]/input", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "e5ae531f-be4b-43eb-995b-73805a55d116",
      "comment": "",
      "command": "click",
      "target": "id=evga_login",
      "targets": [
        ["id=evga_login", "id"],
        ["name=evga_login", "name"],
        ["css=#evga_login", "css:finder"],
        ["xpath=//input[@id='evga_login']", "xpath:attributes"],
        ["xpath=//div[@id='EVGAContent']/div/div/div/div/form/div/div/table/tbody/tr/td[2]/input", "xpath:idRelative"],
        ["xpath=//td[2]/input", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "70fbafa2-ee87-45b3-8506-f5a3d2553749",
      "comment": "",
      "command": "click",
      "target": "name=password",
      "targets": [
        ["name=password", "name"],
        ["css=tr:nth-child(2) > td:nth-child(2) > input", "css:finder"],
        ["xpath=//input[@name='password']", "xpath:attributes"],
        ["xpath=//div[@id='EVGAContent']/div/div/div/div/form/div/div/table/tbody/tr[2]/td[2]/input", "xpath:idRelative"],
        ["xpath=//tr[2]/td[2]/input", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "09963a2e-ad4d-4a87-a00a-158762d094cf",
      "comment": "",
      "command": "click",
      "target": "name=password",
      "targets": [
        ["name=password", "name"],
        ["css=tr:nth-child(2) > td:nth-child(2) > input", "css:finder"],
        ["xpath=//input[@name='password']", "xpath:attributes"],
        ["xpath=//div[@id='EVGAContent']/div/div/div/div/form/div/div/table/tbody/tr[2]/td[2]/input", "xpath:idRelative"],
        ["xpath=//tr[2]/td[2]/input", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "0c05517a-3ccc-440d-b5c2-5a444f048b74",
      "comment": "",
      "command": "doubleClick",
      "target": "name=password",
      "targets": [
        ["name=password", "name"],
        ["css=tr:nth-child(2) > td:nth-child(2) > input", "css:finder"],
        ["xpath=//input[@name='password']", "xpath:attributes"],
        ["xpath=//div[@id='EVGAContent']/div/div/div/div/form/div/div/table/tbody/tr[2]/td[2]/input", "xpath:idRelative"],
        ["xpath=//tr[2]/td[2]/input", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "15702351-134c-4bf8-b5e1-6d578bcb53c9",
      "comment": "",
      "command": "selectFrame",
      "target": "index=0",
      "targets": [
        ["index=0"]
      ],
      "value": ""
    }, {
      "id": "cb10166c-dae9-4ef5-8fb1-d29bc84ccc6f",
      "comment": "",
      "command": "click",
      "target": "css=.recaptcha-checkbox-border",
      "targets": [
        ["css=.recaptcha-checkbox-border", "css:finder"],
        ["xpath=//span[@id='recaptcha-anchor']/div", "xpath:idRelative"],
        ["xpath=//span/div", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "820b7c96-9bfa-456d-b73c-3f76b2354760",
      "comment": "",
      "command": "selectFrame",
      "target": "relative=parent",
      "targets": [
        ["relative=parent"]
      ],
      "value": ""
    }, {
      "id": "565e1f79-db07-4b9f-960a-498a8fac38c4",
      "comment": "",
      "command": "click",
      "target": "name=login_button",
      "targets": [
        ["name=login_button", "name"],
        ["css=td > .button", "css:finder"],
        ["xpath=//input[@name='login_button']", "xpath:attributes"],
        ["xpath=//div[@id='EVGAContent']/div/div/div/div/form/div/div[2]/table/tbody/tr/td/input", "xpath:idRelative"],
        ["xpath=//div[2]/table/tbody/tr/td/input", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "dcbaea05-ca46-4843-87c3-cd5543c8a31a",
      "comment": "",
      "command": "click",
      "target": "id=LFrame_CheckoutButton",
      "targets": [
        ["id=LFrame_CheckoutButton", "id"],
        ["name=ctl00$LFrame$CheckoutButton", "name"],
        ["css=#LFrame_CheckoutButton", "css:finder"],
        ["xpath=//input[@id='LFrame_CheckoutButton']", "xpath:attributes"],
        ["xpath=//div[@id='LFrame_pnlMain']/div[2]/input[3]", "xpath:idRelative"],
        ["xpath=//div[2]/input[3]", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "e1177536-8867-43d7-9473-5de8bcb3e0c4",
      "comment": "",
      "command": "click",
      "target": "css=.js-ship-buttons > .btnCheckoutContinue",
      "targets": [
        ["css=.js-ship-buttons > .btnCheckoutContinue", "css:finder"],
        ["xpath=//input[@value='Continue']", "xpath:attributes"],
        ["xpath=//div[@id='doc']/div[3]/div[3]/input[2]", "xpath:idRelative"],
        ["xpath=//div[3]/input[2]", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "ce73be63-e4f8-4fe5-8ff9-746c70431acd",
      "comment": "",
      "command": "click",
      "target": "css=.modal-content .btnCheckoutContinue",
      "targets": [
        ["css=.modal-content .btnCheckoutContinue", "css:finder"],
        ["xpath=(//input[@value='Continue'])[2]", "xpath:attributes"],
        ["xpath=//div[@id='modalSuggestAddress']/div/div[2]/input[2]", "xpath:idRelative"],
        ["xpath=//div/div[2]/input[2]", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "faa986be-00ff-434f-96df-4c5a28491b58",
      "comment": "",
      "command": "click",
      "target": "id=cbAgree",
      "targets": [
        ["id=cbAgree", "id"],
        ["name=cbAgree", "name"],
        ["css=#cbAgree", "css:finder"],
        ["xpath=//input[@id='cbAgree']", "xpath:attributes"],
        ["xpath=//div[@id='divShipFee']/p/input", "xpath:idRelative"],
        ["xpath=//p/input", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "0d2070d6-b40a-4b55-943f-e4c7e1431e5c",
      "comment": "",
      "command": "click",
      "target": "css=div:nth-child(3) > label",
      "targets": [
        ["css=div:nth-child(3) > label", "css:finder"],
        ["xpath=//div[@id='divShipFeeList']/div[3]/label", "xpath:idRelative"],
        ["xpath=//div[3]/label", "xpath:position"],
        ["xpath=//label[contains(.,'UPS 2nd Day Air ($25.60)')]", "xpath:innerText"]
      ],
      "value": ""
    }, {
      "id": "99a922f8-9601-4683-9c3d-c822bbfe5f2c",
      "comment": "",
      "command": "click",
      "target": "id=ctl00_LFrame_btncontinue",
      "targets": [
        ["id=ctl00_LFrame_btncontinue", "id"],
        ["name=ctl00$LFrame$btncontinue", "name"],
        ["css=#ctl00_LFrame_btncontinue", "css:finder"],
        ["xpath=//input[@id='ctl00_LFrame_btncontinue']", "xpath:attributes"],
        ["xpath=//p[@id='checkoutButtons']/input[2]", "xpath:idRelative"],
        ["xpath=//p/input[2]", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "0c44e735-a3f6-42d6-8310-0ee813cd8be3",
      "comment": "",
      "command": "click",
      "target": "id=rdoCreditCard",
      "targets": [
        ["id=rdoCreditCard", "id"],
        ["name=ctl00$LFrame$rdoPaymentType", "name"],
        ["css=#rdoCreditCard", "css:finder"],
        ["xpath=//input[@id='rdoCreditCard']", "xpath:attributes"],
        ["xpath=//div[@id='creditOuter']/div/div/div[2]/input", "xpath:idRelative"],
        ["xpath=//div/div[2]/input", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "3a3084da-9fb1-45b3-bf66-e3ba246fd482",
      "comment": "",
      "command": "click",
      "target": "id=ctl00_LFrame_btncontinue",
      "targets": [
        ["id=ctl00_LFrame_btncontinue", "id"],
        ["name=ctl00$LFrame$btncontinue", "name"],
        ["css=#ctl00_LFrame_btncontinue", "css:finder"],
        ["xpath=//input[@id='ctl00_LFrame_btncontinue']", "xpath:attributes"],
        ["xpath=//div[@id='ctl00_LFrame_ctl00_LFrame_btncontinuePanel']/input", "xpath:idRelative"],
        ["xpath=//div[6]/div[2]/div/input", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "c61042a7-397e-4244-b995-20411fb0b3aa",
      "comment": "",
      "command": "click",
      "target": "id=ctl00_LFrame_txtNameOnCard",
      "targets": [
        ["id=ctl00_LFrame_txtNameOnCard", "id"],
        ["name=ctl00$LFrame$txtNameOnCard", "name"],
        ["css=#ctl00_LFrame_txtNameOnCard", "css:finder"],
        ["xpath=//input[@id='ctl00_LFrame_txtNameOnCard']", "xpath:attributes"],
        ["xpath=//div[@id='ctl00_LFrame_pnlCCInfo']/p/input", "xpath:idRelative"],
        ["xpath=//div[3]/div/div/div/p/input", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "269c60fa-9758-4954-9326-e19d970d9e33",
      "comment": "",
      "command": "type",
      "target": "id=ctl00_LFrame_txtNameOnCard",
      "targets": [
        ["id=ctl00_LFrame_txtNameOnCard", "id"],
        ["name=ctl00$LFrame$txtNameOnCard", "name"],
        ["css=#ctl00_LFrame_txtNameOnCard", "css:finder"],
        ["xpath=//input[@id='ctl00_LFrame_txtNameOnCard']", "xpath:attributes"],
        ["xpath=//div[@id='ctl00_LFrame_pnlCCInfo']/p/input", "xpath:idRelative"],
        ["xpath=//div[3]/div/div/div/p/input", "xpath:position"]
      ],
      "value": "John Doe"
    }, {
      "id": "50a5a7d2-1eb7-480e-a206-3eb6087b90a2",
      "comment": "",
      "command": "type",
      "target": "id=ctl00_LFrame_txtCardNumber",
      "targets": [
        ["id=ctl00_LFrame_txtCardNumber", "id"],
        ["name=ctl00$LFrame$txtCardNumber", "name"],
        ["css=#ctl00_LFrame_txtCardNumber", "css:finder"],
        ["xpath=//input[@id='ctl00_LFrame_txtCardNumber']", "xpath:attributes"],
        ["xpath=//div[@id='ccNum']/input", "xpath:idRelative"],
        ["xpath=//div[5]/div[3]/div/div/div/div/input", "xpath:position"]
      ],
      "value": "555555555555555"
    }, {
      "id": "5801fce4-f227-4b19-a926-5b0b15f935ce",
      "comment": "",
      "command": "select",
      "target": "id=ctl00_LFrame_ddlYear",
      "targets": [],
      "value": "label=2023"
    }, {
      "id": "5a7c188f-1255-4364-80ce-780bb32b5fbc",
      "comment": "",
      "command": "click",
      "target": "id=ctl00_LFrame_txtCvv",
      "targets": [
        ["id=ctl00_LFrame_txtCvv", "id"],
        ["name=ctl00$LFrame$txtCvv", "name"],
        ["css=#ctl00_LFrame_txtCvv", "css:finder"],
        ["xpath=//input[@id='ctl00_LFrame_txtCvv']", "xpath:attributes"],
        ["xpath=//div[@id='ctl00_LFrame_pnlCCInfo']/p[4]/input", "xpath:idRelative"],
        ["xpath=//div[3]/div/div/div/p[4]/input", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "ef76fc52-dc5e-4691-a8c3-023d207918ce",
      "comment": "",
      "command": "type",
      "target": "id=ctl00_LFrame_txtCvv",
      "targets": [
        ["id=ctl00_LFrame_txtCvv", "id"],
        ["name=ctl00$LFrame$txtCvv", "name"],
        ["css=#ctl00_LFrame_txtCvv", "css:finder"],
        ["xpath=//input[@id='ctl00_LFrame_txtCvv']", "xpath:attributes"],
        ["xpath=//div[@id='ctl00_LFrame_pnlCCInfo']/p[4]/input", "xpath:idRelative"],
        ["xpath=//div[3]/div/div/div/p[4]/input", "xpath:position"]
      ],
      "value": "123"
    }, {
      "id": "c428297a-386e-4418-8f74-0e03722f2658",
      "comment": "",
      "command": "click",
      "target": "id=ctl00_LFrame_ImageButton2",
      "targets": [
        ["id=ctl00_LFrame_ImageButton2", "id"],
        ["name=ctl00$LFrame$ImageButton2", "name"],
        ["css=#ctl00_LFrame_ImageButton2", "css:finder"],
        ["xpath=//input[@id='ctl00_LFrame_ImageButton2']", "xpath:attributes"],
        ["xpath=(//div[@id='checkoutButtons']/input[2])[2]", "xpath:idRelative"],
        ["xpath=//div[3]/input[2]", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "773c838a-f504-42ab-bee5-ddf83390fa98",
      "comment": "",
      "command": "click",
      "target": "id=ctl00_LFrame_cbAgree",
      "targets": [
        ["id=ctl00_LFrame_cbAgree", "id"],
        ["name=ctl00$LFrame$cbAgree", "name"],
        ["css=#ctl00_LFrame_cbAgree", "css:finder"],
        ["xpath=//input[@id='ctl00_LFrame_cbAgree']", "xpath:attributes"],
        ["xpath=//div[@id='checkoutFooter']/p/input", "xpath:idRelative"],
        ["xpath=//div[5]/p/input", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "a21c061e-f95d-4f25-9c1b-ae8569edc32f",
      "comment": "",
      "command": "mouseOver",
      "target": "id=ctl00_LFrame_cbAgree",
      "targets": [
        ["id=ctl00_LFrame_cbAgree", "id"],
        ["name=ctl00$LFrame$cbAgree", "name"],
        ["css=#ctl00_LFrame_cbAgree", "css:finder"],
        ["xpath=//input[@id='ctl00_LFrame_cbAgree']", "xpath:attributes"],
        ["xpath=//div[@id='checkoutFooter']/p/input", "xpath:idRelative"],
        ["xpath=//div[5]/p/input", "xpath:position"]
      ],
      "value": ""
    }, {
      "id": "3af9e108-4717-4ffb-8d30-3ced71a43d40",
      "comment": "",
      "command": "mouseOut",
      "target": "id=ctl00_LFrame_cbAgree",
      "targets": [
        ["id=ctl00_LFrame_cbAgree", "id"],
        ["name=ctl00$LFrame$cbAgree", "name"],
        ["css=#ctl00_LFrame_cbAgree", "css:finder"],
        ["xpath=//input[@id='ctl00_LFrame_cbAgree']", "xpath:attributes"],
        ["xpath=//div[@id='checkoutFooter']/p/input", "xpath:idRelative"],
        ["xpath=//div[5]/p/input", "xpath:position"]
      ],
      "value": ""
    }]
  }],
  "suites": [{
    "id": "b6cdab30-c446-4cd9-822e-e0fc95795371",
    "name": "Default Suite",
    "persistSession": false,
    "parallel": false,
    "timeout": 300,
    "tests": ["52733568-b31b-41a2-8991-4a999a5ef456"]
  }],
  "urls": ["https://www.evga.com/products/product.aspx?pn=08G-P4-3065-KR"],
  "plugins": []
}

Intoxicus
Was hoping you would explain how it works in the video. I'm very curious for an in depth technical explanation.

Crazy to see it in action though.

m0camb0
As you work in cybersecurity, you must be aware that our work is always a compromise between convenience and security, adding 3 captchas adds a lot of inconvenience to legitimate users. 

Unlox

Spurious_ECG
Basically if you can't beat them because sites are not taking appropriate action, you need to join them to buy a card for your own personal use 

Yeah, its a weird situation because using automated tools like this isn't illegal or even penalized in terms of service so using a bot seems okay to most companies as long as they're making sales. Makes sense in times like this where companies are filing bankruptcy left and right due to the pandemic. The ethics of it are wonky as well, I feel it would be fun if some cards were raffled away and people could pay if they win the raffle. Probably the best chance a normal person would have agaisnt a professional bot lol
 

yaggaz

m0camb0
As you work in cybersecurity, you must be aware that our work is always a compromise between convenience and security, adding 3 captchas adds a lot of inconvenience to legitimate users. 

I can't speak for everyone, but I'd be more than happy to go three 3 captchas if I knew it would increase my chances of getting the product AND as an added bonus, was screwing over bots and scalpers.

 
Yeah same, I just think there are plenty of options. That was just off the top and I think using it for only launch days would be good. Still it's more about slowing them down than stopping them. Automatically measuring time between user actions and rate/speed of data entry after initial user login could also mitigate some of these bots.

Hoggle
I think the real problem is even if you put three layers of catcha before checkout we would run into the problem of thousands of people trying and crashing the site all at once. Also we would see a lot of people complain that they had it in the cart and are about to check out but they missed a bicycle rushing to check out and had to do bridges and when they finished that one they found it sold out.

kalen37
 Or follow Nvidia's lead. They have stated they are going to manually go through all sales via their store and make sure they are all non-bot sales.
 
 I mean you say one per a household, make the botters have a unique address per unit to ship to.

vulcan1978
"EVGA please spend more money implementing an anti-bot solution that means less profit for you as the bots buy your cards 40x at a time without the 5% associate discount code!" 
 
Never going to happen. 
 
Like NV, EVGA DOESN'T GIVE A (removed) ABOUT YOU. 
 
At the end of the day EVGA is a Corporation. 
 
https://youtu.be/zpQYsk-8dWg
 
 Edit language removed by Cool GTX