What is CreepJS Browser Fingerprint and How to Bypass It

Browser fingerprinting represents a sophisticated method of collecting comprehensive information about a user’s browser environment to create a unique digital identifier or fingerprint for that specific user.

This technique leverages JavaScript to systematically gather detailed information about a user’s browser configuration, operating system specifications, geographical location, time zone settings, system languages, available fonts, installed extensions, connected devices, and screen resolution parameters. This collected data forms a distinctive digital fingerprint that maintains consistency across multiple browsing sessions, providing greater reliability compared to conventional tracking methods such as cookies.

This comprehensive guide will explore the intricate mechanisms behind CreepJS, one of the most prominent browser fingerprinting tools available today. We’ll examine its core advantages and inherent limitations, demonstrate practical implementation with popular browser automation frameworks, and explore alternative solutions that provide comparable functionality.

Key Takeaways

• Learn how creepjs detects browser fingerprinting vulnerabilities and JavaScript tampering in anti-fingerprinting tools using Canvas, WebGL, and audio fingerprinting.
• Implement CreepJS fingerprinting analysis to detect JavaScript tampering and prototype lies in anti-fingerprinting tools
• Configure Canvas, WebGL, and audio fingerprinting techniques for comprehensive browser environment profiling
• Use entropy analysis and trust score calculations to identify browser fingerprinting vulnerabilities and inconsistencies
• Implement anti-fingerprinting measures using stealth browser automation tools like undetected-chromedriver
• Configure browser privacy settings and fingerprint spoofing to avoid detection and maintain anonymity
• Use specialized tools like Webparsers for automated fingerprint management with anti-blocking features

What is CreepJS?

CreepJS stands as an open-source Javascript-based project specifically engineered to identify security leaks and vulnerabilities present in contemporary anti-fingerprinting solutions.

CreepJS incorporates several essential features that effectively help identify privacy vulnerabilities, fingerprinting patterns, and critical weaknesses in browser anti-fingerprinting technologies:

JavaScript Tampering Detection:

The system detects and systematically ignores prototype lies generated by anti-fingerprinting techniques, effectively revealing deliberate attempts to modify the standard behavior of browser APIs.

Fingerprint Profiling:

It creates comprehensive fingerprint profiles by capturing distinctive browser behaviors. This encompasses device properties, rendering capabilities, and browser-specific characteristics.

Browser Privacy Settings Analysis:

CreepJS thoroughly examines privacy-related browser configurations to identify inconsistencies and deviations, highlighting specific areas where user privacy might be potentially compromised.

Large-Scale Data Collection Simulation:

The tool simulates extensive data collection processes, validating the robustness of anti-fingerprinting measures across various APIs (such as Canvas, WebGL, and others) while collecting consistency data on how browsers handle this information.

New API Detection:

CreepJS identifies newly introduced or recently updated APIs that are susceptible to fingerprinting and could potentially compromise user privacy.

Cross-Browser and Cross-Platform Testing:

CreepJS is specifically designed to test an extensive range of browsers and platforms, including both desktop and mobile environments. It compares and highlights privacy vulnerabilities across these diverse environments.

Detailed Reporting:

The system provides comprehensive reports on detected fingerprinting vulnerabilities, including the potential risk assessment of re-identification based on various browser traits.

High Entropy Data Collection:

This tool focuses specifically on capturing high-entropy data, including GPU rendering capabilities, system fonts, and network conditions, to assess the volume of information that can be utilized for fingerprinting purposes.

Having explored the fundamental concept and purpose of CreepJS, we now turn our attention to its inner workings. While understanding what CreepJS is provides context for its role in browser fingerprinting, delving into how it operates reveals the true sophistication of this tool.

How does CreepJS work?

CreepJS’s operation can be systematically broken down into several key phases: data collection, processing, and comprehensive analysis. CreepJS systematically gathers information from numerous browser APIs, examines how the browser renders different elements, and even detects attempts to mask or alter this information. Let’s dive deeper into each of these steps to understand the intricate workings of this powerful fingerprinting tool.

Data Collection:

CreepJS systematically collects an extensive range of data points from the user’s browser and connected device. This comprehensive data includes information about the browser window properties, navigator specifications, screen metrics, rendering capabilities (including Canvas and WebGL), audio context data, installed font libraries, CSS styling information, mathematical calculations, console error logs, and numerous additional parameters. The primary objective is to gather maximum information possible to create a truly unique fingerprint.

Hashing:

Following data collection, CreepJS employs sophisticated hashing algorithms to create unique identifiers for each collected piece of information. The hashing process converts the collected data into fixed-size character strings, which are significantly easier to compare and store efficiently. This process facilitates the creation of a compact representation of the fingerprint.

Fingerprint Creation:

Utilizing the hashed data, CreepJS constructs a comprehensive fingerprint object. This object contains all collected and hashed information, systematically organized into distinct categories such as browser features, screen properties, audio capabilities, font information, and additional parameters. This fingerprint serves as a unique identifier for the specific user’s browser and device combination.

API Interaction:

CreepJS interfaces with several APIs to process and analyze the fingerprint data:

A Prediction API is utilized to decrypt and analyze fingerprints, comparing them against established known patterns.

A Fingerprint API computes a detailed fingerprint profile based on unique patterns detected during analysis.

A Web Traffic API analyzes patterns in web traffic to detect anomalies or suspicious behavioral patterns.

These APIs work collaboratively to process the fingerprint data and generate valuable insights.

Entropy Analysis:

CreepJS calculates the entropy (a quantitative measure of uniqueness or randomness) of various fingerprint components. This analysis helps in understanding how distinctive each aspect of the fingerprint actually is. Higher entropy values indicate that a particular feature is more unique and therefore more valuable for identification purposes.

Trust Score:

Based on various factors, including the consistency of the fingerprint over extended time periods, detected “lies” (inconsistencies in reported data), and other behavioral patterns, CreepJS computes a comprehensive trust score. This score indicates the probability that the fingerprint represents a genuine, unmodified browser environment.

Resistance Detection:

CreepJS includes sophisticated mechanisms to detect and fingerprint various privacy-enhancing technologies and specialized browsers. This includes identifying features specific to browsers like Tor, Firefox with privacy enhancements, Brave, and others. It also attempts to detect privacy-focused browser extensions and tools that might be trying to mask or alter the browser’s true fingerprint.

Rendering Results:

Finally, CreepJS presents the analyzed fingerprint data through a user-friendly interface. This typically includes visualizations of various metrics, the calculated trust score, predictions about the browser environment, and detailed breakdowns of the fingerprint components. This allows users (or researchers) to understand the uniqueness of their browser fingerprint and see what information might be leaking.

Now that we understand the core concepts of CreepJS’s operation, let’s explore some the techniques and methodologies employed by CreepJS that enable CreepJS to create such detailed and unique browser fingerprints.

CreepJS Fingerprinting Techniques

CreepJS represents a sophisticated browser fingerprinting solution that employs a comprehensive array of techniques to create detailed and unique profiles of a user’s browser and device configuration. These techniques are not merely theoretical concepts but practical implementations of advanced web technologies. Let’s examine them in detail.

Canvas Fingerprinting

Canvas fingerprinting utilizes the HTML5 Canvas element to render graphics and text, subsequently generating a hash from the resulting image data.

CreepJS collects various data points:

• Image rendering
• Paint operations
• Text rendering
• Emoji rendering
• Text metrics

WebGL Fingerprinting

WebGL (Web Graphics Library) fingerprinting exploits the differences in how GPUs and graphics drivers render 3D scenes.

CreepJS collects detailed WebGL information:

• WebGL parameters
• GPU model and vendor information
• Supported extension
• Rendering capabilities

Audio Fingerprinting

Audio fingerprinting uses the Web Audio API to generate and analyze audio signals. CreepJS implements this technique by collecting audio metadata:

• Audio processing characteristics
• Frequency and time domain data
• Compressor gain reduction
• Sample sums

Screen Fingerprinting

Screen fingerprinting gathers information about the user’s display. CreepJS collects screen data:

• Screen resolution
• Color depth
• Pixel depth
• Available screen space
• Device pixel ratio

Note: CreepJS also uses CSS media queries to gather additional screen-related information.

These techniques combined provide a comprehensive fingerprint of the user’s device, making it difficult for users to hide their identity or use spoofing techniques without being detected. The fingerprints generated from these sources are then hashed and combined with other data points to create a unique identifier for the device and browser combination.

Using CreepJS with Browser Automation Tools

CreepJS, with its advanced detection capabilities, presents a unique hurdle for browser automation. It’s designed to identify not just the browser itself, but also any attempts to mask or alter the browser’s true identity – a common practice in automated browsing scenarios. This creates a fascinating cat-and-mouse game between fingerprinting techniques and automation tools.

Let’s explore how popular frameworks like Playwright, Selenium, and Puppeteer intersect with sophisticated fingerprinting mechanisms like CreepJS.

For this we will:

• Start a web browser
• Tell it to go to the CreepJS test page hosted on github
• Wait 5 seconds for all tests to complete
• Take a screenshot of the full page and save it to a file

Playwright

To explore playright’s fingerprint with CreepJS. Install playwright in your python environment using the following pip command:

$ pip install playwright

Next, install your preferred browser web drivers of choice, we will use the Chromium web drivers

$ playwright install chromium

To open CreepJS using playwright, run the following python script:

from pathlib import Path
from playwright.sync_api import sync_playwright
import time

with sync_playwright() as p:
    browser = p.chromium.launch()
    context = browser.new_context()
    page = context.new_page()

    page.goto("https://abrahamjuliot.github.io/creepjs/")
    # wait for 5 seconds after page loads
    time.sleep(5)
    # take a screenshot of the full page
    page.screenshot(path="full-page-screenshot.png", full_page=True)

Selenium

To explore selenium’s fingerprint with CreepJS. Install selenium in your python environment using the following pip command:

$ pip install selenium

You will also need to install ChromeDriver through the official download link. Make sure the driver file is in the same path as your pyhton script file.

To open CreepJS using selenium, run the following python script:

from selenium import webdriver
import time

driver = webdriver.Chrome()

driver.get("https://abrahamjuliot.github.io/creepjs/")
# wait for 5 seconds after page loads
time.sleep(5)
# take a screenshot of the full page
driver.save_screenshot("full-page-screenshot-selenium.png")

Puppeteer

To explore puppeteer’s fingerprint with CreepJS. Inintialize a node.js project and install selenium using the following commands:

$ npm init
$ npm install puppeteer

To open CreepJS using puppeteer, run the following javascript code:

const puppeteer = require("puppeteer");

async function sleep(ms) {
  return new Promise((resolve) => setTimeout(resolve, ms));
}

async function main() {
  const browser = await puppeteer.launch({
    headless: false,
  });
  let page = await browser.newPage();
  
  await page.goto("https://abrahamjuliot.github.io/creepjs/", {
    waitUntil: "domcontentloaded",
  });
  // wait for 5 seconds after page loads
  await sleep(5000);
  # take a screenshot of the full page
  await page.screenshot({ path: "screenshot.png", fullPage: true });
  await page.close();
  await browser.close();
}

main();

With these scripts we can see exactly how our automated browsers are being fingerprinted by CreepJS. Next, let’s use this information to fortify our web scrapers against detection.

Fortifying Web Scrapers Against CreepJS Detection

Many web browser automation tools inadvertently reveal information about themselves to JavaScript execution contexts. This means that JavaScript can easily detect if the browser is being controlled by a program instead of a human, allowing fingerprinting tools like CreepJS to quickly identify a web scraper. Strengthening our fingerprint should be our initial priority – we must conceal the traces left by our web scrapers.

The leaks uncovered by browser automation tools are widely recognized within the web scraping community. Therefore, all major browser automation tools used for web scraping have numerous extension libraries supported by the community. These libraries share the common goal of fixing any known leaks that could make your scraping tool’s fingerprint easily detectable by tools like CreepJS and others built on similar concepts and techniques.

Introduction to how javascript is used to detect web scrapers. What’s in javascript fingerprint and how to correctly spoof it for web scraping.

Let’s quickly go over some of the popular libraries used with browser automation tools to bypass fingerprint detection:

Playwright

• playwright-extra: a light-weight plugin framework for playwright that allows adding extra plugins, most importantly the stealth plugin which applies various evasion techniques to make detection of playwright harder.
• undetected-playwright: A new addition in the stealth libraries race, inspired by playwright-extra. undetected-playwright enhance playwright by making it more difficult to detect when a browser is being controlled programmatically

Selenium

• undetected-chromedriver: a modified selenium webdriver that has bulitin measures to combat websites that block automated headless browsers scraping their pages.
• SeleniumBase UC Mode: a feature of SeleniumBase that allows bots to appear human, which lets them evade detection from anti-bot services that try to block them or trigger CAPTCHAs on various websites. UC Mode is based on undetected-chromedriver, but includes multiple updates, fixes, and improvements.

Puppeteer

• puppeteer-extra-plugin-stealth: a popular plugin for puppeteer-extra, the puppeteer counterpart of playwright-extr also use to to prevent anti-bot detection.
• rebrowser-puppeteer: a fork of puppeteer patched with rebrowser-patches, which is a collection of patches for puppeteer and playwright to avoid automation detection and leaks.

Tutorial on how to avoid web scraper blocking. What is javascript and TLS (JA3) fingerprinting and what role request headers play in blocking.

CreepJS Limitations

While CreepJS is a powerful and sophisticated browser fingerprinting tool, it’s important to recognize that it’s not without its limitations. Understanding these limitations is crucial for researchers, developers, and privacy professionals to accurately assess the tool’s strengths and weaknesses in the context of digital fingerprinting and online privacy.

• Ethical concerns: The extensive data collection and fingerprinting techniques used by CreepJS raise significant privacy concerns and may be seen as invasive by users.
• Potential for false positives: The complex nature of the fingerprinting process might lead to misidentification of legitimate users as using privacy tools or spoofing attempts.
• Arms race with privacy tools: As CreepJS improves its detection capabilities, privacy tools and browsers will likely adapt, leading to an ongoing cat-and-mouse game.
• Browser updates: Frequent browser updates might change or remove access to some of the APIs CreepJS relies on, potentially affecting its effectiveness over time.
• Limited scope: CreepJS is primarily designed for research and demonstration purposes, and its use is limited to its GitHub page.
• Complexity: The intricate nature of CreepJS might make it challenging to implement and maintain in real-world applications.

In summary, while CreepJS is a powerful and comprehensive fingerprinting tool with advanced detection capabilities, its use comes with significant ethical, legal, and practical considerations that need to be carefully weighed.

CreepJS Alternatives

The landscape of browser fingerprinting is diverse, with various tools and libraries offering different approaches and capabilities; CreepJS is not the only player in the field. Understanding these alternatives is crucial for developers, researchers, and privacy advocates to gain a broader perspective on the current state of fingerprinting technology.

FingerprintJS

FingerprintJS is a browser fingerprinting library that operates on the client side and is source-available. It collects browser attributes and uses them to create a hashed identifier for each visitor. Because FingerprintJS generates fingerprints directly in the browser, its accuracy ranges between 40% and 60%. This means that if two different users access the service using browsers that are identical in version, vendor, and platform, FingerprintJS will be unable to differentiate between the two due to the identical attributes.

To see how it works and view your own unique browser fingerprint, FingerprintJS offers a live demo available here.

Broprint.js

Broprint.js is a JavaScript library that generates a unique identifier for different browsers, such as Chrome, Firefox, or any other browsers that support canvas and audio fingerprinting. Browser fingerprinting can be easily implemented with this library. Check out the live demo.

Webparsers Fingerprint Tools

Webparsers hosts a variety of tools to assist with automation development. We use these tools for internal development and share them online.

Webparsers’ fingerprinting tools can generate browser fingerprints using various browser fingerprinting techniques:

• JA3 Fingerprint
• HTTP/2 Fingerprint
• Canvas Fingerprint
• Webgl Fingerprint
• Audio Fingerprint
• Screen Fingerprint
• Browser Fingerprint

Which match most capabilities of CreepJS and more!

Bypass Anti-Scraping Techniques with Webparsers

At Webparsers we spend countless hours working on understanding javascript fingerprinting to provide javascript rendering and anti scraping protection bypass features.

Webparsers provides web scraping, screenshot, and extraction APIs for data collection at scale. Each product is equipped with an automatic bypass for any anti-bot system and we achieve this by:

• Maintaining a fleet of real, reinforced web browsers with real fingerprint profiles.
• Millions of self-healing proxies of the highest possible trust score.
• Constantly evolving and adapting to new anti-bot systems.

We’ve been doing this publicly since 2020 with the best bypass on the market!

It takes Webparsers several full-time engineers to maintain this system, so you don’t have to!

Summary

In this article, we have taken a look at the most popular browser fingerprint testing tool, CreepJS, and what makes it special.

We have covered what CreepJS is, its inner workings, and how it implements several browser fingerprint techniquest. Further, we have taken a look at how these fingerprint techniques can be bypassed using stealth enhancements for Puppetter, Playwright and Selenium.

Finally, take note that fingeprinting is a constantly evolving field and you can find the latest fingerprint tests on Webparsers fingerprint tools page.