This project combines two major forks:
A research-focused tool designed for security testing, capable of simulating multiple fingerprint layers to match Chrome/Chromium behavior. It also performs IP rotation every 5 requests.
Supports:
- IP Rotation (via GitHub Actions)
- Bypass Javascript Bot Detection:
- WebDriver
- JA4 (TLS fingerprint)
- JA4H (HTTP fingerprint)
- JA4X (X509 certificate fingerprint)
- JA4T (TCP fingerprint)
You can adapt catcher-microsoft-login.py or catcher-fingerprint.py to customize how requests are crafted during security research and detection-evasion testing. These adjustments are useful for evaluating how infrastructures respond when multiple fingerprint layers and IP validation mechanisms are in place—for example, when assessing defenses against scenarios such as password spraying, brute-force attempts, or MFA validation abuse.
We can note different IP Addresses and the same JA4 hash (impersonating chrome):
