WebDriver Detection

The most fundamental detection signal. When a browser is under automated control, the navigator.webdriver property is set to true. This is a W3C standard flag that automation tools must set. Genuine user browsers return undefined or false. Detection scripts check this property directly, but sophisticated bots may attempt to override it using JavaScript injection or CDP commands to mask their presence.

Selenium WebDriver modifies the document.documentElement by appending a custom attribute. The attribute name follows the pattern driver-evaluate with a random suffix. Detection involves:

• Checking document.documentElement.getAttribute() for keys matching known patterns
• Inspecting the outerHTML of the document element for injected attributes
• Monitoring for $cdc_ and $chrome_ prefixed attributes that indicate Selenium's presence

These attributes persist even when navigator.webdriver is overridden.

Automated browsers exhibit distinct differences in the window object compared to normal instances:

• window.chrome object: In headless Chrome, this is often empty or missing specific properties like runtime
• window.navigator.plugins: Headless browsers typically return an empty array with zero length
• window.outerWidth and window.outerHeight: Often report as 0 in headless mode
• Notification.permission: Defaults to denied in headless, while normal browsers show default

These inconsistencies form a composite fingerprint for detection.

Cross-referencing the User-Agent string against actual browser capabilities reveals automation:

• A User-Agent claiming Chrome 120 on Windows, but navigator.platform returning Linux x86_64 indicates headless mode
• navigator.hardwareConcurrency reporting unrealistic core counts for the claimed device
• navigator.deviceMemory returning undefined or mismatched values
• WebGL renderer strings showing SwiftShader or Google SwiftShader instead of actual GPU names

These mismatches between declared and actual environment are strong automation indicators.

Automated browsers handle permissions and sensor APIs differently:

• Permissions.query() for notifications, camera, or microphone returns denied by default in headless
• BatteryManager API is unavailable in headless Chrome, while present in normal browsers
• Sensor APIs like Gyroscope and Accelerometer are absent or throw errors in emulated environments
• SpeechSynthesis.getVoices() returns an empty array in headless mode

These API gaps create a detectable profile distinct from genuine user hardware.

A set of techniques used to identify web requests originating from browsers running without a graphical user interface. Detection relies on probing for missing rendering artifacts or JavaScript API inconsistencies that occur when no display server is attached.

• Checks for navigator.webdriver property set to true
• Tests for missing plugins like Chrome PDF Viewer
• Evaluates screen dimensions (often 0x0 or unusual defaults)
• Probes for requestAnimationFrame timing irregularities

Headless Chrome and PhantomJS leave distinct fingerprints that differ from standard user-facing browser installations.

The process of identifying automated traffic by analyzing non-human behavioral patterns. Bots exhibit telltale signatures that diverge from genuine user interaction.

• Superhuman speed: Form submissions or page transitions faster than human reaction time (< 200ms)
• Perfectly linear mouse movements: Zero curvature or natural jitter in cursor trajectories
• Missing environmental attributes: Absence of standard browser properties like navigator.plugins or navigator.mimeTypes
• Uniform timing intervals: Requests spaced at exact, non-random intervals

These signatures are often combined with device fingerprinting for higher confidence classification.

A browser fingerprinting technique that exploits the HTML5 Canvas API to render a hidden graphic and capture subtle variations in the device's graphics hardware and driver stack.

• Renders text and geometric shapes to an off-screen canvas element
• Extracts the base64-encoded pixel data via toDataURL()
• Different GPU models, drivers, and OS configurations produce microscopic rendering differences
• Creates a highly stable, unique identifier even when cookies are cleared

WebDriver-controlled browsers often produce canvas fingerprints that differ from standard installations, providing a detection signal.

The technique of identifying a falsified User-Agent HTTP header string by cross-referencing the claimed browser identity against actual JavaScript engine behaviors and rendering capabilities.

• Compares navigator.userAgent against navigator.appVersion and navigator.platform
• Tests JavaScript API availability specific to the claimed browser version
• Validates CSS feature support against expected capabilities
• Checks for inconsistencies between HTTP header UA and navigator object UA

Automation tools frequently spoof user agents but fail to replicate the complete behavioral profile of the claimed browser.

A method of identifying a client application by analyzing the specific parameters and cipher suites advertised in the Transport Layer Security handshake, creating a signature independent of the IP address.

• Examines the ClientHello message structure
• Catalogs supported TLS versions, cipher suites, extensions, and elliptic curves
• Each browser and automation library produces a distinct TLS fingerprint
• Remains consistent even when IP addresses rotate or user agents change

Selenium and Puppeteer often use default TLS stacks that differ from genuine browser TLS implementations.

The process of combining behavioral and device attributes collected during a single user session to build a unique, time-bound identifier for detecting session hijacking and replay attacks.

• Aggregates WebDriver detection signals with device fingerprint data
• Monitors behavioral biometrics like mouse dynamics and keystroke patterns
• Tracks session-level consistency of browser properties
• Detects abrupt changes indicating session takeover or tool switching

A session that begins with a clean browser but suddenly exhibits WebDriver properties mid-session is a strong indicator of compromise.