percie1/antibot-fingerprinter — explained in plain English
Analysis updated 2026-05-18
Identify which WAF or anti-bot vendor protects a target website you are authorized to test.
Inspect response headers, cookies, and TLS certificates for security stack clues.
Detect layered security stacks where multiple vendors handle different jobs.
Extend the tool with custom vendor signatures for internal or niche services.
| percie1/antibot-fingerprinter | 0xallam/my-recipe | 0xhassaan/nn-from-scratch | |
|---|---|---|---|
| Stars | 0 | — | 0 |
| Language | Python | Python | Python |
| Last pushed | — | 2022-11-22 | — |
| Maintenance | — | Dormant | — |
| Setup difficulty | easy | moderate | moderate |
| Complexity | 2/5 | 2/5 | 4/5 |
| Audience | developer | general | developer |
Figures from each repo's GitHub metadata at analysis time.
Only requires the requests library, use only on authorized targets per the README's legal notice.
antibot-fingerprinter is a passive HTTP fingerprinting tool that identifies which web application firewall or anti-bot service a website uses, based on a single normal request rather than active scanning or payloads. It can recognize vendors including Cloudflare, Akamai, DataDome, AWS CloudFront, PerimeterX, Imperva, Shape Security, and Fastly by looking at specific response headers, cookies, and TLS certificate details that each vendor tends to leave behind. The README explains the reasoning behind staying passive: active scanning techniques like fuzzing or directory brute forcing tend to trigger rate limits, IP bans, and firewall block rules before you learn anything useful. A passive approach instead reads signals that a server already broadcasts on every ordinary request, so one plain GET request is enough to identify the stack. Knowing which vendor is in front of a site matters because each one calls for a different approach: Akamai implies behavioral sensors are watching mouse and keyboard activity, DataDome implies TLS fingerprint checks, and Cloudflare implies JavaScript challenge handling. Using the tool is a single command line call that takes a target URL, and it prints the HTTP status code, the notable response headers, TLS certificate details like issuer and subject alternative names, and a list of detected vendors with the specific signals that triggered each match. The README notes that sites often run more than one vendor layered together, each handling a different job such as caching versus bot management. The tool can be extended by adding a new entry to a signatures dictionary in the source file, specifying headers, server values, cookies, and body patterns to match for a new vendor. Installation only requires cloning the repository and installing the requests library with pip. The README states this tool performs passive analysis only and should be used only on targets you are authorized to test or that fall within a bug bounty program's scope. It is released under the MIT license.
A passive command line tool that identifies which WAF or anti-bot vendor, like Cloudflare or Akamai, protects a website from a single normal HTTP request.
Mainly Python. The stack also includes Python, requests.
MIT license: free to use, copy, modify, and distribute, as long as you keep the original copyright notice.
Setup difficulty is rated easy, with roughly 5min to a first successful run.
Mainly developer.
This repo across BitVibe Labs
double-check against the repo, no cap.