A detailed reverse engineering analysis of Vercel's BotID anti-bot protection system. The post demonstrates how to deobfuscate the JavaScript protection script using Babel AST transformations, reveals the browser fingerprinting techniques used (WebGL detection, CDP detection, user agent analysis), and shows how the Basic mode can be bypassed with simple patches. The analysis also covers the Deep Analysis mode powered by Kasada's more sophisticated virtual machine-based protection.
Table of contents
PreambleIntroductionSetting up BotIDDiscovering the c.js ScriptUnderstanding the ObfuscationWriting the ToolUnderstanding the X FunctionThe Browser Signal PayloadBypassing the ChecksTesting Detection with PlaywrightDeep Analysis ModeConclusionFootnotesSort: