devtools-detect

For me it's "Sorry,, You can not view this website when JaveScript is disabled, Thank you" I have JavaScript enabled. Looking at the website's HTML source code a lot of logic seems (bad) copy&pasted from other wordpress plugins. For example there's logic that disables right-click, too. > import devtools from 'https://www.dinbyggare.se/wp-content/plugins/wccp-pro/index....'; That's version 2.1 of https://github.com/sindresorhus/devtools-detect Meanwhile version 4 was released and even the maintainer writes "This package has a lot of flaws. It used to work better, but browsers changed, and the detection now has too many false-positives."

Looking at the code[0], it just defines an aspect ratio threshold (170px in either direction, on line 13) for your browser's viewport and triggers if it's outside of that on width or height. So when you open a second panel, your viewport goes back to being closer to 16:9/16:10 and the tool considers that within both thresholds. The detection is hilariously primitive, entirely unreliable, and only knows about your devtools directly if you're using Firebug. [0]: https://github.com/sindresorhus/devtools-detect/blob/main/in...

https://sindresorhus.com/devtools-detect/ https://github.com/sindresorhus/devtools-detect EDIT: doesn't seem to work if I have devtools as a separate window

One of the ways this is detected is by window resizing. You can see an example npm package that can detect devtools here: https://github.com/sindresorhus/devtools-detect

Devtools can actually be detected to a certain extent - https://github.com/sindresorhus/devtools-detect

What out for "Devtools detect" :) https://github.com/sindresorhus/devtools-detect

As someone who has worked on scraping sites that really didn't want to be scraped, there is all kinds of interference with dev tools in the wild. There are many ways to detect it's open (eg. https://github.com/sindresorhus/devtools-detect) and it's also possible to mess with it without knowing it's open. A method that's wildly used is firing the debugger break command many times a second, along with other stuff that makes using the tools nearly impossible (slows the browser down to a halt)

The site's dead now - the DNS record was pulled about an hour ago. But, I got a snapshot of the site and all the code before it got taken down, and I took the liberty of deobfuscating the big blobs of code: https://github.com/nneonneo/steam-phishing-analysis It's fairly simple code, in the end. The phishers copied the legitimate trading site, as well as the Steam Community login page, and then added some JavaScript code to both as well as tweaking the HTML a bit. In total, three snippets of JS were added: the first detects debuggers using https://github.com/sindresorhus/devtools-detect (the bit that the original blog poster found), the second pops open the fake browser chrome and sticks the fake login page inside an iframe, and the third (running in the iframe) harvests credentials off the copied Steam login page.

Typically it seems to poll window height/width vars in js. https://github.com/sindresorhus/devtools-detect Another variant: https://stackoverflow.com/questions/7798748/find-out-whether...