1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
delete window.;
delete window.;
delete window.;
delete window.;
delete window.;
delete window.;
delete window.;
delete window.;
delete window.;
delete window.;
// ============================================================================
// CRITICAL SECURITY: navigator.automationTools Protection (October 2025)
// ============================================================================
//
// IMPLEMENTATION: Natural Undefined Approach (October 2025 Standard)
//
// We protect against automationTools detection by leveraging JavaScript's
// natural undefined behavior instead of explicit property definition.
//
// WHY THIS APPROACH IS SUPERIOR:
//
// OLD APPROACH (Detectable):
// Object.defineProperty(navigator, 'automationTools', { get: () => undefined });
// - Creates property descriptor → DETECTABLE via Object.getOwnPropertyDescriptor()
// - Property exists in 'in' operator check → DETECTABLE
// - Appears in Object.getOwnPropertyNames() → DETECTABLE
// - Returns undefined ✓ (functional but leaves fingerprint)
//
// OCTOBER 2025 APPROACH (Undetectable):
// [Use JavaScript's natural behavior - no code needed]
// - No property descriptor → UNDETECTABLE
// - 'automationTools' in navigator returns false → UNDETECTABLE
// - Absent from all enumeration methods → UNDETECTABLE
// - Returns undefined naturally ✓ (functional AND zero fingerprint)
//
// PROTECTION MECHANISM:
// Modern bot detection (DataDome, Kasada, PerimeterX) scans for phantom
// properties using 'in' operator and Object.getOwnPropertyNames(). By NOT
// defining the property, we achieve:
// 1. navigator.automationTools returns undefined (protection maintained)
// 2. Zero detection footprint (no enumeration trace)
// 3. Identical behavior to real Chrome (perfect stealth)
//
// VERIFICATION:
// See kromekover_tests.rs for comprehensive tests verifying:
// - Property doesn't exist in 'in' operator check
// - Property absent from Object.keys() and Object.getOwnPropertyNames()
// - No property descriptor exists
// - Returns undefined naturally (functional verification)
//
// WARNING: Do not add Object.defineProperty for automationTools. Natural
// undefined is the ONLY undetectable approach for October 2025 standards.
// Any developer who changes this will compromise stealth infrastructure.
// ============================================================================
// Note: navigator.webdriver protection is handled by evasions/navigator_webdriver.js
// (injected after this script - see mod.rs for injection order)
Object.;