A special build of curl that can impersonate Chrome and Firefox

https://news.ycombinator.com/rss Hits: 34
Summary

A special build of curl that can impersonate the four major browsers: Chrome, Edge, Safari & Firefox. curl-impersonate is able to perform TLS and HTTP handshakes that are identical to that of a real browser. curl-impersonate can be used either as a command line tool, similar to the regular curl, or as a library that can be integrated instead of the regular libcurl. See Usage below. When you use an HTTP client with a TLS website, it first performs a TLS handshake. The first message of that handshake is called Client Hello. The Client Hello message that most HTTP clients and libraries produce differs drastically from that of a real browser. If the server uses HTTP/2, then in addition to the TLS handshake there is also an HTTP/2 handshake where various settings are exchanged. The settings that most HTTP clients and libraries use differ as well from those of any real browsers. For these reasons, some web services use the TLS and HTTP handshakes to fingerprint which client is accessing them, and then present different content for different clients. These methods are known as TLS fingerprinting and HTTP/2 fingerprinting respectively. Their widespread use has led to the web becoming less open, less private and much more restrictive towards specific web clients With the modified curl in this repository, the TLS and HTTP handshakes look exactly like those of a real browser. To make this work, curl was patched significantly to resemble a browser. Specifically, The modifications that were needed to make this work: Compiling curl with nss, the TLS library that Firefox uses, instead of OpenSSL. For the Chrome version, compiling with BoringSSL, Google's TLS library. Modifying the way curl configures various TLS extensions and SSL options. Adding support for new TLS extensions. Changing the settings that curl uses for its HTTP/2 connections. Running curl with some non-default flags, for example --ciphers , --curves and some -H headers. The resulting curl looks, from a network pers...

First seen: 2025-04-03 16:57

Last seen: 2025-04-05 02:03