carcosa

The problem

Standard automation tools like Playwright and Selenium are easily flagged by modern anti-bot systems because their underlying network stacks and execution patterns leave distinct fingerprints. Even with stealth plugins, inconsistencies between TLS handshakes, HTTP/2 settings, and TCP options often lead to immediate blocks or shadowbans.

What it does

• Generates coherent "Stranger" identities where TLS extensions, HTTP/2 frames, and TCP SYN options are cross-audited for consistency.
• Bypasses detection via a custom Rust network stack built from raw TLS 1.3 bytes, avoiding common fingerprints from OpenSSL or rustls.
• Simulates human-plausible mouse movement using Egregore trajectories with randomized curvature, jitter, and element-specific aim bias.
• Classifies server responses to identify specific security vendors like Cloudflare, DataDome, and Akamai while suggesting remediation steps.
• Automates robots.txt analysis to identify honeypots, hidden links, and crawl budget constraints before interaction.

Frameworks & tools

Built with Rust. Interfaces via a multicall binary or SOCKS5/Tor proxies. Integrated with YouTube Innertube API for native playback simulation.

Why this beats prompting it yourself

Generic LLM prompts cannot fix a leaked TLS fingerprint or an inconsistent TCP window size. This skill provides a specialized low-level toolkit that handles the complex math of KDF schedules and wire-level protocol enforcement that standard libraries abstract away.

Use cases

• Scraping high-security targets that block standard headless browsers.
• Auditing site security by identifying traps, honeypots, and WAF vendors.
• Automating native YouTube playback and stream extraction without triggering bot detection.
• Testing geographic coherence and ASN-based reachability across residential or proxy networks.

Known limitations

Requires a local Rust environment to compile the carcosa-rs crate. The Stranger identity does not spoof existing browsers; it presents a unique, coherent identity that some sites may block by default. Updates roll in consistently.

Donate

ko-fi.com/anjaevermoor