Danny-Dasilva

CycleTLS

Go2022–2026

Danny-Dasilva / CycleTLS

CycleTLS

Spoof TLS/JA3 fingerprints in GO and Javascript

Web Development Networking

Explore on GitHub Read Hacker News discussions

3Distinct people

4Mentions

0Explicit recommenders

1.5KGitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

Spoof TLS/JA3 fingerprints in GO and Javascript

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year4 dated mentions

Observed mentions: 2022-05-22 10:32:59 UTC to 2026-08-18 14:50:58 UTC.

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Comments
2022	2022-01-01 00:00:00 UTC	2023-01-01 00:00:00 UTC	2	2
2023	2023-01-01 00:00:00 UTC	2024-01-01 00:00:00 UTC	0	0
2024	2024-01-01 00:00:00 UTC	2025-01-01 00:00:00 UTC	0	0
2025	2025-01-01 00:00:00 UTC	2026-01-01 00:00:00 UTC	0	0
2026 (partial)	2026-01-01 00:00:00 UTC	2027-01-01 00:00:00 UTC	2	2

What Hacker News says

4 sources

psanford·Aug 18, 2026

There are a bunch of these tools out there. I like curl-impersonate[0] as a quick way to make curl fingerprint as chrome or firefox. There's also CylceTLS[1] for a more programmatic approach. [0]: https://github.com/lwthiker/curl-impersonate [1]: https://github.com/Danny-Dasilva/CycleTLS

In Show HN: A local MitM proxy to control TLS fingerprints

denysvitali·May 31, 2026

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecologically a nightmare), probably fingerprinting is the way to go - completely destroying the privacy of everyone involved. Cromite, a privacy conscious fork of Chromium for Android, has constantly issues with CloudFlare Turnstile [2] because they (Cloudflare) try to fingerprint it in multiple ways in order to pass the challenge. The only way to get it to work would be to join the CloudFlare Browser Developer program - which requi

Read the rest

res signing an NDA. Rightfully so, the project maintainer didn't want to do it. If you want to see the extent of what CloudFlare does to fingerprint the browsers, just have a look in the issue [2] and see which flags need to be disabled in order to allow CloudFlare to pass the challenge. I understand both sides, but at least CloudFlare could be flexible enough to fall back to PoW instead of just blocking people from sending forms or accessing websites... [1]: https://github.com/Danny-Dasilva/CycleTLS [2]: https://github.com/uazo/cromite/issues/2365

In Cloudflare Turnstile requiring fingerprintable WebGL

denysvitali·Sep 2, 2022

Faced a similar issue while I was trying to programmatically interact with a website that I'll not mention. Surprisingly the website had a protection for which I was able to use their API via the browser, but not from cURL or Go. I was puzzled at first, then I understood what was going on. Basically what's being described in this article. Cloudflare was adding this "protection" against "unauthorized TLS fingerprints", and of course the Go HTTP / TLS client and cURL weren't on that list. To work around the issue (in Go), I simply used a customized version of this: https://github.com/Danny-Dasilva/CycleTLS

In Curl’s TLS Fingerprint

avastel·May 22, 2022

"These API routes, like any API that pulls data from a database, are necessary to the day-to-day functioning of Stack Overflow. To protect routes like these from DDoS, here’s what you can do: - Insist that every API call be authenticated. This will help identify malicious users. If having only authenticated API calls is not possible, set stricter limits for anonymous / unauthenticated traffic. - Minimize the amount of data a single API call can return. When we build our front page question list, we don’t retrieve all of the data for every question. We paginate, lazy load only the data in the viewport, and request only the data that will be visible (that is, we don’t request the text for every answer until loading the question page itself). - Rate-limit all API calls. This goes hand-in-hand with minimizing data per call; to get large amoun

Read the rest

ts of data, the attacker will need to call the API multiple times. Nobody needs to call your API a hundred times per second. Filter malicious traffic before it hits your application. HAProxy load balancers sit between all requests and our servers to balance the amount of traffic across our servers. But that doesn’t mean all traffic has to go to one of those servers. - Implement thorough and easily queryable logs so malicious requests can be easily identified and blocked." When using HAProxy you can also try to leverage TLS/JA3 fingerprints (https://haproxy.com/blog/announcing-haproxy-2-5/) While it can still be spoofed using several packages , e.g. https://github.com/Danny-Dasilva/CycleTLS it can still provide a meaningful/easy-to-manipulate signal. Moreover, most bots conducting L7 DDoS don't use real/headless browsers in order to be able to scale their attack, so it's highly likely they'll have a discriminating/inconsistent TLS fingerprint. This can also be done directly in Fastly using e.g. https://developer.fastly.com/reference/vcl/variables/client-... Another approach to proactively flag malicious IPs is to scrape free proxies. Indeed, most DDoS leverage lot of cheap/know bad IPs. It's frequent to see these free proxies in these attacks.

In Stack under attack: what we learned about handling DDoS attacks