Akamai Bot Manager Internals

https://proofofbots.github.io/akamai-internals
Admin
Akamai Bot Manager Internals provides technical analysis and measurement notes on Akamai Bot Manager...
Tokens:21,412
Snippets:150
Trust Score:9.7
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Bit decoding example for segment aYOGDfhYcEiODrXO

Source: https://proofofbots.github.io/akamai-internals/configuration.html

Worked example of the bit decoding on a real segment served today. Each character pair yields one bit, producing the binary value 11011101.

```text
segment   a Y  O G  D f  h Y  c E  i O  D r  X O
bit        1    1    0    1    1    1    0    1     ->  11011101
```

--------------------------------

### Derive pixel hash from seed with XOR

Source: https://proofofbots.github.io/akamai-internals/pixel-challenge.html

Derives the hash used in the pixel client paths from the seed. The comment shows the expected result for the example seed.

```javascript
const hash = (77 ^ bazadebezolkohpepadr).toString(16);
// 1320943881 ^ 77 === 0x4ebc0144
```

--------------------------------

### Trampoline function into dispatcher

Source: https://proofofbots.github.io/akamai-internals/sensor-script.html

Most named functions are trampolines into control-flow-flattened dispatchers. This example shows the typical shape of such a trampoline.

```javascript
function xY(){ return hH.apply(this, [0x3f, arguments]); }
```

--------------------------------

### Generation 2 plaintext example

Source: https://proofofbots.github.io/akamai-internals/payload-format.html

Shows the structure of a Generation 2 plaintext: a four-entry preamble followed by code-data pairs. The separator is not transmitted; it is inferred as the text between the first two '2's.

```plaintext
2 <sep> 2 <sep> 7a74G7m23Vrp0o5c961547nSUuCfDMvBzj2S2zmHgqNw== <sep> 168332 <sep> -100 <sep> …
```

--------------------------------

### Sensor telemetry payload

Source: https://proofofbots.github.io/akamai-internals/edge-surface.html

Example telemetry payload posted to the sensor URL. The sensor posts to the path it was served from with POST and content-type: application/json, containing a single key sensor_data. The response is 201 {"success": true}, but that status is not a verdict; it returns for garbage, truncated bodies, and moved keys.

```json
{ "sensor_data": "2;2048;4338485;3553350;19,0,0,0,1,0;<ciphertext>" }
```

--------------------------------

### Preamble token generation with dpt and key

Source: https://proofofbots.github.io/akamai-internals/payload-format.html

Generates the 46-character preamble token using a custom character rotation function 'dpt' and a fixed key. The key is derived by rotating a constant string, and the token combines the key with the rotated current hour bucket and a static suffix. The hour bucket ensures the token changes hourly, enabling replay detection.

```javascript
const dpt = (text, key) => { /* rotate characters 48..57 by key charCode, letters untouched */ };

const key = dpt("0a46G5m17Vrp4o4c", "afSbep8yjnZUjq3aL010jO15Sawj2VZfdYK8uY90uxq").slice(0, 16);
const token = key + dpt(String(Math.floor(Date.now() / 3600000)), key) + "nSUuCfDMvBzj2S2zmHgqNw==";
```

--------------------------------

### SHA-1 initial state constants

Source: https://proofofbots.github.io/akamai-internals/pixel-challenge.html

Initial state of the stock SHA-1 hash primitive, recognisable from these constants baked into the pixel client.

```text
1518500249, 1859775393, 2400959708, 3395469782
```

--------------------------------

### Pixel client wiring with inline seed and script tags

Source: https://proofofbots.github.io/akamai-internals/pixel-challenge.html

Inline seed and two script tags that wire the pixel client. The seed is the only value that must arrive intact; the script recomputes the POST path itself.

```html
<script type="text/javascript">bazadebezolkohpepadr="1320943881"</script>
<script type="text/javascript" src="/akam/13/4ebc0144"></script>
<script type="text/javascript" src="/akam/13/pixel_4ebc0144?a=<base64>"></script>
```

--------------------------------

### Create browserless client Session with Chrome TLS profile

Source: https://proofofbots.github.io/akamai-internals/transport.html

Creates a browserless client session that impersonates a Chrome TLS profile. The randomTlsExtensionOrder option keeps extension order randomisation on, matching Chrome's per-connection GREASE behaviour. Used to reproduce the transport fingerprint before posting sensor_data.

```javascript
const session = new Session({
  clientIdentifier: ClientIdentifier[profile],
  timeout,
  insecureSkipVerify: false,
  randomTlsExtensionOrder: true,
});
```

--------------------------------

### Detect opaque sensor path by shape

Source: https://proofofbots.github.io/akamai-internals/edge-surface.html

Identifies the opaque sensor path by shape: four or more segments, each 2-24 characters of [A-Za-z0-9_-], no file extension, and not under /akam/. Use this to find the live sensor path on current configurations, which is not named /akam/<generation>/<hash>.

```javascript
const looksObfuscated = (href) => {
  const path = href.startsWith("http") ? new URL(href).pathname : href;
  const segments = path.split("/").filter(Boolean);

  if (segments.length < 4) return false;
  if (/\.[a-z0-9]{2,4}$/i.test(path)) return false;
  if (path.includes("/akam/")) return false;

  return segments.every((segment) => /^[A-Za-z0-9_-]{2,24}$/.test(segment));
};
```

--------------------------------

### Proof-of-work message and remainder calculation

Source: https://proofofbots.github.io/akamai-internals/proof-of-work.html

Constructs the message and computes the remainder modulo the difficulty. The prefix uses the token from _abck field 0, not the work item. The nonce is typically Math.random().toString(16).

```javascript
const prefix = `${challenge.token}${startTs}${challenge.salt}`;
const message = `${prefix}${difficulty}${nonce}`;

const remainder = (bytes, modulus) => {
  let value = 0;
  for (const byte of bytes) {
    value = ((value << 8) | byte) >>> 0;
    value %= modulus;
  }
  return value;
};
```

--------------------------------

### Identify Akamai cookies by name and prefix

Source: https://proofofbots.github.io/akamai-internals/edge-surface.html

Lists the Akamai cookie names worth watching and provides a prefix rule that catches the rest. Use isAkamaiCookie to identify Akamai cookies by name or by the ak_ or bm_ prefix.

```javascript
const AKAMAI_COOKIES = ["_abck", "bm_sz", "ak_bmsc", "bm_sv", "bm_mi", "bm_so", "bm_s", "bm_lso", "sec_cpt"];
const isAkamaiCookie = (name) => AKAMAI_COOKIES.includes(name) || /^(ak_|bm_)/.test(name);
```

--------------------------------

### Re-signing formula for edited script

Source: https://proofofbots.github.io/akamai-internals/sensor-script.html

Because the marker is excised before hashing, the stored constant can be recomputed for an edited script. Re-signing after an edit reproduces the same delta, which is used as an offline regression check.

```text
delta  = stored - murmur(original body)
stored = murmur(edited body) + delta
```

--------------------------------

### Compute window position to match metrics override for screen coordinates

Source: https://proofofbots.github.io/akamai-internals/driven-input.html

Computes the real OS window position so mouse event screenX/screenY agree with Emulation.setDeviceMetricsOverride. The override is ignored for screen coordinates, so a browser launched off screen at --window-position=-3200,-3200 emits events whose screen coordinates disagree by 3200 pixels. The 982 constant accounts for browser chrome height.

```javascript
export const WINDOW_POSITION = {
  x: METRICS.positionX,
  y: METRICS.positionY + (982 - METRICS.height),
};
```

--------------------------------

### Sensor script wrapper with signature marker

Source: https://proofofbots.github.io/akamai-internals/sensor-script.html

The entire sensor script is a single self-calling wrapper. The first statement is a bare expression that serves as the integrity signature marker.

```javascript
(function qRgxPcXAER(){MT();0xcff0cc1,2656862855;M2T();f2T();…}());
```

--------------------------------

### Generate permutation swap pairs

Source: https://proofofbots.github.io/akamai-internals/payload-format.html

Generates the swap pairs for the permutation pass. The body is split on a separator (',' for v2, ':' for v3), then for each index two positions are drawn and swapped. Undoing it is the same swap list replayed backwards. Decoding order is substitution first, which restores the real separators, then the permutation.

```javascript
const swaps = (count, key) => {
  const pairs = [];
  let state = key;

  for (let index = 0; index < count; index += 1) {
    const first = draw(state) % count;
    state = step(state);
    const second = draw(state) % count;
    state = step(state);
    pairs.push([first, second]);
  }

  return pairs;
};
```

--------------------------------

### Shuffle key recovery anchor check

Source: https://proofofbots.github.io/akamai-internals/build-generations.html

Checks if the candidate key places index 0 at a position where the token is '{"ver"', using the inverse of the permutation's index-of-zero. This is a quick filter before full validation.

```javascript
const at = inverseIndexOfZero(order);
if (at === -1 || parts[at] !== '{"ver"') continue;
```

--------------------------------

### Canvas probe with SHA-1 hash

Source: https://proofofbots.github.io/akamai-internals/pixel-challenge.html

Canvas probe that draws text and rectangles, then hashes the canvas dataURL. The output is a single hash, so per-load noise injection produces a value that never repeats; a real machine returns the same hash on every load and a stable one across sessions.

```javascript
ctx.fillStyle = "rgba(255,153,153, 0.5)";
ctx.font = "18pt Tahoma";
ctx.fillText("Soft Ruddy Foothold 2", 2, 2);
// three coloured rectangles
ctx.fillText("!H71JCaj)]# 1@#", 4, 8);
sha1(canvas.toDataURL());
```

--------------------------------

### Map typed characters to physical key codes for keydown events

Source: https://proofofbots.github.io/akamai-internals/driven-input.html

Maps a typed character to the physical key and keyCode the sensor expects. Without this, Input.dispatchKeyEvent with only text set produces event.code === "" and event.keyCode === 0, which any keydown listener can see. Shifted characters must be emitted as separate physical keys (ShiftLeft down, KeyA with shift, then keyups).

```javascript
if (/^[a-z]$/i.test(base)) return { code: `Key${upper}`, keyCode: upper.charCodeAt(0), shift };
if (/^[0-9]$/.test(base)) return { code: `Digit${base}`, keyCode: base.charCodeAt(0), shift };

const PUNCTUATION = {
  "-": ["Minus", 189], "=": ["Equal", 187], ";": ["Semicolon", 186],
  "'": ["Quote", 222], ",": ["Comma", 188], ".": ["Period", 190],
  "/": ["Slash", 191], "`": ["Backquote", 192], " ": ["Space", 32],
};
```

--------------------------------

### Detect sensor_data frame shape by field tests

Source: https://proofofbots.github.io/akamai-internals/payload-format.html

Detection of the frame shape by testing fields rather than counting them. The same build frames differently depending on the channel, so a parser that assumes a fixed header length is wrong for one of the two v2 shapes. The generation 3 token in header field 5 also appears inside the plaintext as ver, a cheap self-check that the body was decoded correctly.

```javascript
const full =
  parts.length > 5 &&
  NUMERIC.test(parts[1]) && NUMERIC.test(parts[2]) && NUMERIC.test(parts[3]) &&
  TIMINGS.test(parts[4]);
```

--------------------------------

### Work item format in _abck field 4

Source: https://proofofbots.github.io/akamai-internals/proof-of-work.html

Format of the work items carried in _abck field 4, separated by || and each field by -.

```text
<id>-<salt>-<difficulty>-<delay>-<slice>[-<version>]
```

--------------------------------

### Flag host-derived segment

Source: https://proofofbots.github.io/akamai-internals/configuration.html

Returns the parsed segment and a flag indicating whether the segment came from the hostname. Used when the sensor is served from /akam/13/<hash>, where the fourth-from-last segment is the hostname and the bits are an artefact of the URL shape rather than a setting.

```javascript
return { segment, fromHost: segment === host };
```
Tokens:
Raw