Live data from Hacker News

Bypassing website anti-scraping protections

kb.apify.com

101–110 of 121 posts

Re: Bypassing website anti-scraping protections

#101
> we have developed a solution which removes the property from the web browser and thus prevents these kind of protections from figuring out that the browser is automated

Eli Grey and I have bypassed your "hideWebDriver()" function[1] in a single line of code:

    if (navigator.webdriver || (Navigator.prototype && Object.getOwnPropertyDescriptors(Navigator.prototype)["webdriver"])) {
        // Chrome headless detected - navigator.webdriver exists or was redefined
    }
[1]: https://github.com/apifytech/apify-js/blob/262a2e604b1adb3d8...

Re: Bypassing website anti-scraping protections

#103
post #101

> we have developed a solution which removes the property from the web browser and thus prevents these kind of protections from figuring out that the browser is automated Eli Grey and I have bypassed your "hideWebDriver()" function[1] in a single line of code: if (navigator.webdriver || (Navigator.prototype && Object.getOwnPropertyDescriptors(Navigator.prototype)["webdriver"])) { // Chrome headless detected - navigat…

Good point. Haven't seen a single detection library do this, but at least now I know, that I still need to work on alternative solution. Thanks

Re: Bypassing website anti-scraping protections

#104

Earlier quoted context omitted.

This sounds like an issue that is specific to Javascript-controlled browsers. If using a traditional, non-Javascript tcp/tls/http client it is trivial to extract the image urls and other information from the page using a single HTTP request (and from each successive page using more HTTP requests in a single connection, if "has_next_page" is "true"). No "API" needed. Can you provide an example of a single page with 10…

https://www.instagram.com/ryuji513 It looks like it just hits https://www.instagram.com/graphql/query/.. . every time you scroll down so if you scroll too fast it just hammers it and throttles your requests to that endpoint.

[deleted]

Re: Bypassing website anti-scraping protections

#105

Earlier quoted context omitted.

This sounds like an issue that is specific to Javascript-controlled browsers. If using a traditional, non-Javascript tcp/tls/http client it is trivial to extract the image urls and other information from the page using a single HTTP request (and from each successive page using more HTTP requests in a single connection, if "has_next_page" is "true"). No "API" needed. Can you provide an example of a single page with 10…

https://www.instagram.com/ryuji513 It looks like it just hits https://www.instagram.com/graphql/query/.. . every time you scroll down so if you scroll too fast it just hammers it and throttles your requests to that endpoint.

1. Fetch 1st page.

Note id of user (e.g. 1954202703). this is the "id": value in the url.

Note end_cursor. This is used for the "after": value in the url

Note rhx_gis. This is used to create the "X-Instagram-GIS:" header.

Looking at archive.org, it seems as recently as last year, end_cursor was once all that was needed.

2. Fetch js from ProfilePageContainer url in 1st page (e.g., https://www.instagram.com/static/bundles/base/ProfilePageCon...)

Note queryId (e.g. 42323d64886122307be10013ad2dcc44)

This is used for "query_hash" in the url.

3. Create header "X-Instagram-GIS:"

Apparently this is some MD5 hash of rhx_gis and the query string variables according to this source:

https://www.diggernaut.com/blog/how-to-scrape-pages-infinite...

However a little experimentation revealed that generation of rhx_gis or this hash must also incorporate the user-agent string -- change any character in the user-agent string and the request will fail.

They also put IP address and a Unix time value in a cookie but the cookie can be deleted and the request still succeeds.

For example the final url for the first 12 photos is:

https://www.instagram.com/graphql/query/?query_hash=42323d64...

Overall, seems not too much work for someone who really wants to automate retrieval of Instagram photos. These requests for successive groups of 12 can be RFC 2616 pipelined over a single connection. Not long ago and for some number of years, it was even easier (e.g. just use end_cursor value as "max_id" in url).

Re: Bypassing website anti-scraping protections

#106
Scraping on high volumes any serp is pain if your business relies on it and most services out there do not work on high volumes or they work and crazy expensive.

I have checked few solutions out there, I am using now proxycrawl. Developers of their api helped me get a very high volume of Serp data from different search engines like Yandex, google and yahoo and bing. I also use them for Javascript crawling as for our project we need lots of content which is rendered via javascript. I am amazed of how their API endpoint works. It is basically sending a URL to their API and you are good to start. Make sure to contact them for some sites as they do not allow you to crawl the world by default unless you prove your use case, they liked my product and that is how it got started. I've really having successful experience with it so I totally recommend, you basically communicate with developers who does lots of work to make it happen. As I am mainly in JS I asked for a Node JS package and they just built it open sourced. https://github.com/proxycrawl/proxycrawl-node

Re: Bypassing website anti-scraping protections

#107

Earlier quoted context omitted.

Eh, the principle might be good (though it's not odd that not everyone shares the same principles), but one can hold it and still have exceptions. For example, what about a governmental institution or a public company¹? What about a semi-public company, like a monopolist utility? What if the uploader of the data is OK with it, but the site hoster prevents it? ¹ in the sense of owned by the State, not listed on the st…

I'm not saying there aren't legitimate reasons for writing scrapers. I've written plenty myself. It was just odd to see this disregarded entirely. As for the commonality of principles, game theory explains most of them, so it isn't more surprising than that we all work with the same prime numbers, say. A simple principle of reciprocity will produce something along the lines of "respect other people's wishes".

It was just odd to see this disregarded entirely.

I can't say I agree. I mean, a serious, interesting essay can certainly be written on the ethics of scraping. But these short preludes on technical posts just end up sounding either like a disingenuous legal disclaimer or a preachy paternalistic tirade.

Re: Bypassing website anti-scraping protections

#108
post #2

There is an irony in google preventing web scraping given that their business is pretty much built on web scraping.

Shameless plug: it’s why we made SerpApi! ( https://serpapi.com )

I find serp api very interesting but the big data plan is very expensive still for medium size companies. Does it really work for Google?

Re: Bypassing website anti-scraping protections

#109
post #106

Scraping on high volumes any serp is pain if your business relies on it and most services out there do not work on high volumes or they work and crazy expensive. I have checked few solutions out there, I am using now proxycrawl. Developers of their api helped me get a very high volume of Serp data from different search engines like Yandex, google and yahoo and bing. I also use them for Javascript crawling as for our…

It would be interesting to know what technologies they use to scrape on high volume for 0.005 US cent a successful request. I checked this package and it looks decent, i like dependency free libraries. I'll check their API for Bing. Thanks

Re: Bypassing website anti-scraping protections

#110

Earlier quoted context omitted.

Instagram is the worst I have come across. If you are on a page with 1000+ pictures trying to find something near the bottom, you have to let it load each new group sequentially, then after a while it starts timing you out for like 60 seconds or longer every couple times you load more. God forbid you accidentally navigate away while scrolling you have to start all over again from the top. Due to recent events it seem…

Linkedin is even worse, imo. Go to any random company page and it'll show you a page, asking you to login. Refresh it again and it'll show you the page, without asking you to login.

That is probably because LinkedIn Authwall algorithm is on A/B testing, they do lots of machine learning so that they stop bots, but mostly scraping Linkedin is quite impossible i would say even on small volumes
Post reply on HN