Skip to main content

Challenge flow (with t parameter)

warning

Countless backend errors? Please report them to us and we will attempt to resolve your issue as soon as possible!

SBSD challenge flow can be easily identified by the fact that response lacks any real page content and contains a script tag on top of response with v and t query parameters. An example of such response is shown below:

<!DOCTYPE html>
<html lang="en">
<body><script type="text/javascript" src="/oh9-FCgd0/yhU7kLks/Ff0U2kh_/4s/Xz9OG03zOm9L/Hkg8dEgB/bGR/NdH5kJmR8?v=78225c20-0424-cb9d-3fba-9216b7e617d0&amp;t=939508737"></script> <!-- This is SBSD script -->
<script>
    (function() {
        var chlgeId = '';
        var scripts = document.getElementsByTagName('script');
        for (var i = 0; i < scripts.length; i++) {
            if (scripts[i].src && scripts[i].src.match(/t=([^&#]*)/)) {
                chlgeId = scripts[i].src.match(/t=([^&#]*)/)[1];
            }
        }
        var proxied = window.XMLHttpRequest.prototype.send;
        window.XMLHttpRequest.prototype.send = function() {
            var pointer = this
            var intervalId = window.setInterval(function() {
                if (pointer.readyState === 4 && pointer.responseURL && pointer.responseURL.indexOf('t=' + chlgeId) > -1) {
                    if (window.self === window.top) {
                        location.reload(true);
                    }
                    clearInterval(intervalId);
                }
            }, 1);
            return proxied.apply(this, [].slice.call(arguments));
        };
    })();
</script>
<script type="text/javascript"  src="/oh9-FCgd0/yhU7kLks/Ff0U2kh_/4s/aY9OG03zOm9LJ1VY9Y/cCo1dEgB/WC1/QAgAYR2AB"></script></body> <!-- This is V3 script. DO NOT PARSE -->
</html>

It's immediately solved and the payload is sent back to the same endpoint that served the script, BUT without v parameter. Request contains a JSON {"body":"JDSK73?/sdf..."} characteristic to SBSD. After the payload is sent, you shouldn't be SBSD blocked on the same User-Agent and IP for a while.

Akamai Web V3 still has to be solved to obtain a valid _abck cookie.

Key customer-side detection vectors​

  1. Proxies - Akamai is very sensitive to proxy quality. At very least, use a sticky/static proxy from country of app's target audience. We recommend using a high-quality residential or ISP proxy provider.
  2. TLS fingerprint - Your HTTP client must match the TLS fingerprint of the target platform.
  3. Header order - Header order must match real requests' one. Use HTTP proxy to inspect the actual request/response bodies.

If any of those are unfamiliar to you, please visit Getting started for more information.

Flow​

info

Remember to maintain the same HTTP client, cookie jar, proxy and correct headers, header order across the full flow. Otherwise, you will be blocked by SBSD.
Your interaction must appear as a single, coherent HTTP session to the target server.

1. Initial page request​

Make a GET request to the target page; homepage, product page, etc. The response will contain a script tag with v and t query parameters. This is the SBSD script that you need to parse and solve.

2. Parse the script URL​

Extract the script URL from the response. It will look something like this:

https://example.com/oh9-FCgd0/yhU7kLks/Ff0U2kh_/4s/Xz9OG03zOm9L/Hkg8dEgB/bGR/NdH5kJmR8?v=78225c20-0424-cb9d-3fba-9216b7e617d0&t=939508737

Please also save the POST URL without v parameter, which will be used to send the challenge solution back to the server:

https://example.com/oh9-FCgd0/yhU7kLks/Ff0U2kh_/4s/Xz9OG03zOm9L/Hkg8dEgB/bGR/NdH5kJmR8?t=939508737

3. GET the script URL​

Make a GET request to the script URL to retrieve the script content.

4. Generate challenge solution​

Generate the challenge solution using the Veris Labs API. You will have to provide the following parameters:

solution, _, err := client.SolveAkamaiWebSBSDChallenge(
    context.Background(),
    /* User agent */     "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
    /* Script URL */     "https://example.com/oh9-FCgd0/xyz/xyz?v=78225c20-0424-cb9d-3fba-9216b7e617d0?t=939508737",
    /* Script bytes */   scriptBytes,
    /* Language */       "en-US,en;q=0.9",
    /* Page URL */       "https://example.com/product-page",
    /* Cookie (bm_so) */ "D8BF3D9435A99E335FCB7F522966F100544A9E059FD424D879DBAF63DC1AF601~YAAQcR...",
)

The language argument accepts either a plain BCP-47 tag (e.g. en-US) or the full Accept-Language header value captured from the target browser (e.g. en-US,en;q=0.9).

If you don't want to use our Go SDK, you can call the API directly, see API reference for more information.

5. POST the challenge solution​

Post the challenge solution to the same endpoint that served the script, but WITHOUT v parameter. Request contains a JSON {"body":solution}

POST /oh9-FCgd0/yhU7kLks/Ff0U2kh_/4s/Xz9OG03zOm9L/Hkg8dEgB/bGR/NdH5kJmR8?t=939508737 HTTP/2
content-length: 4670
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua: "Not=A?Brand";v="99", "Google Chrome";v="151", "Chromium";v="151"
content-type: application/json
sec-ch-ua-mobile: ?0
accept: */*
origin: https://example.com
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://example.com/product-page
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: ...
priority: u=1, i

{"body":"\"V~H=^\"[\"Gk(_fPzK\"J\"WO.Cv\"k\"24cH..."}

6. Re-request the website​

Make a GET request to the original page you wanted to access. You should now be able to access it without being blocked by SBSD.