[HELP] Bulding Script or .Exe

Discussion & Solutions
1

"Hello Onehack community, I’m having trouble with my code and I need some help.
I am programming a Python script with a login function for a specific website, and it uses Selenium. Can you give me some tips or a way to achieve this? I already have the basic structure. Please?! Thanks for atectiON
(coding in anexe) thanks Utilize Selenium
habbo.txt (5.4 KB)

2

Selenium login flow.txt (867 Bytes)
practical Selenium.txt (857 Bytes)

Try

3

You could also switch from Selenium to Playwright. It’s faster and overall better

4

@Abd_Shk

Corpo da Postagem:

Hello OneHack Community,

I’ve been deep in the trenches of web automation lately, dealing with the usual friction: WAFs, behavioral analysis, and the inevitable “cat and mouse” game with anti-bot providers. Many developers rely on basic Selenium setups or bloated extensions, which are the first things to get flagged by modern fingerprinting engines.

I wanted to share a shift in methodology that I’ve been calling the “Apogeu” Protocol—a zero-dependency, stealth-first architecture for scaling web automation.

The Problem with Standard Automation: Most scripts are transparent because they carry the “bot signature” from the start. Plugins like stealth are good, but they are generic. If the site checks your hardware concurrency, WebGL renderer, or navigator.webdriver flags, you’re burnt before you even reach the login screen.

The “Apogeu” Architecture:

  1. Polymorphic Identity (The DNA): Instead of one static config, the engine uses a fingerprints.json library. Every “battery” of operations pulls a completely new identity (DeviceMemory, hardware concurrency, platform) and injects it via Chrome DevTools Protocol (CDP) before the DOM is even painted.

  2. Digital Amnesia: We don’t just clear cookies. We perform a deep purge (LocalStorage, SessionStorage, and context refresh) between cycles. By treating every batch as a new entity, we break the correlation logic used by behavioral trackers.

  3. CDP Injection vs. JS Injection: We skip the overhead of page-load extensions. We talk directly to the Chromium engine.

    • Example snippet of the CDP shield:

    Python

    driver.execute_cdp_cmd("Page.addScriptToEvaluateOnNewDocument", {
    "source": """
        Object.defineProperty(navigator, 'webdriver', {get: () => undefined});
        Object.defineProperty(navigator, 'platform', {get: () => 'Win32'});
        // WebGL Mocking to hide headless GPU signatures
        const getParameter = WebGLRenderingContext.prototype.getParameter;
        WebGLRenderingContext.prototype.getParameter = function(parameter) {
            if (parameter === 37445) return 'Intel Inc.';
            return getParameter.apply(this, arguments);
        };
    """
})

The Result: A setup that is virtually indistinguishable from a regular user, running in a headless Docker environment with zero external dependencies. No heavy “Anti-Detect” browsers, just pure, native Chromium control.

1.zip (15.6 KB)

5

“Apogeu” Protocol is good for marketing. I say this because this is all Automation 101. Industry standard practises when it comes to automation and web scraping. So far, depending on your needs ofc, you have a very good setup got web scraping. In my opinion, back in the day, in order to code one should have known how to, but nowadays we can make a perfect end result of a script for web scraping. Now with AI, you don’t need to have the knowledge, just write really detailed and in depth prompts of what you want to do or fix.

6

Here’s the thing your “Apogeu” writeup is quietly proving: you’re hand-building tools that already exist, done better. Plain Selenium can’t win — beyond navigator.webdriver it must emit a Runtime.enable CDP call, and that single signal is exactly what DataDome/Cloudflare fingerprint. No fingerprints.json or CDP injection can hide it. So stop patching. Pick a lane :backhand_index_pointing_down: (all of this is for automating an account you’re allowed to — your own / an authorized one.)

:ninja: Lane 1 — swap Selenium for a browser that’s stealth by construction
These are your Apogeu, built right — no webdriver surface to patch in the first place:

  • :repeat_button: patchright — drop-in Playwright, change one import. Kills the Runtime.enable leak a patch physically can’t (runs JS in isolated contexts). Easiest upgrade if you keep Playwright. → pip install patchright && patchright install chromium
  • :dna: nodriver — the author’s own successor to undetected-chromedriver. No Selenium, no chromedriver → the $cdc_/webdriver fingerprint never exists. One import replaces your Selenium + driver + CDP-injection code; tab.cf_verify() clears Turnstile. → pip install nodriver
  • :fox: camoufox — your fingerprints.json done right: spoofs navigator/WebGL/audio/fonts/WebRTC at the C++ level (invisible to JS prop-inspection) and rolls a fresh realistic fingerprint per launch. → pip install -U camoufox[geoip] && camoufox fetch

:high_voltage: Lane 2 — you might not need a browser at all (the move nobody in the thread mentioned)
If the login is a form POST, the real wall isn’t JS — it’s the TLS/JA3 handshake. Forge that and a plain HTTP request logs in:

  1. Chrome DevTools → Network → do your login once → right-click the login POST → Copy → Copy as cURL.
  2. Paste into curlconverter → out comes Python.
  3. Swap requests for curl_cffi and add impersonate="chrome":
import curl_cffi
r = curl_cffi.post("https://site/api/login",
                   json={"user": u, "pass": p}, impersonate="chrome")

→ ~50 ms per login, no Chromedriver, no fingerprint file, and it compiles to a tiny exe.

:package: Lane 3 — turn it into a clean .exe

  • :building_construction: Nuitka, not PyInstaller. It’s a real compiler (Python → C → machine code): far fewer antivirus false-flags, and nobody can unpack your source (a PyInstaller .exe opens with pyinstxtractor in seconds).
python -m nuitka --standalone --onefile --windows-console-mode=disable login.py

↳ Bundling a browser? add --enable-plugin=playwright --playwright-include-browser=chromium (or skip it and drive the user’s own Chrome).

  • :computer_mouse: Botasaurus Desktop — want a clickable app instead of a console exe? It wraps a stealth (undetected + anti-fingerprint) scraper in a real UI + Windows installer. npm run package.
🧰 The full stealth + build stack — 10 more, for edge cases

Stay on Selenium’s muscle memory: SeleniumBase SB(uc=True) UC/CDP mode (disconnects webdriver during bot checks) · selenium-driverless · undetected-chromedriver (legacy, use nodriver instead).
CDP-native controllers: DrissionPage (12k★, mixes HTTP + browser; CN docs) · zendriver (maintained nodriver fork).
No-browser TLS clients: primp (simplest Rust one) · wreq (JA4 + Chrome149) · tls-client (utls, fallback).
Hybrid: hrequests — HTTP path, .render() promotes the same session into a stealth browser only when a JS challenge hits.
JS-evasion add-on: playwright-stealth v2 (Stealth() context manager).
Exe helpers: Selenium Manager auto-fetches the matching driver (drop --add-binary) · PyInstaller if you must — the fix for these libs: pyinstaller --onefile --collect-all curl_cffi --hidden-import _cffi_backend (it drops the DLL + cacert.pem otherwise).

The bot signature isn’t something you hide — it’s something you never emit. Delete the driver, not the fingerprints.

7

In Lane 2, ‘‘import curl_cffi
r = curl_cffi.post(“https://site/api/login”,
json={“user”: u, “pass”: p}, impersonate=“chrome”)’’ if the site asks for an OTP code after the login, I guess that does not work, right?

I am an authorized user of the account, but requesting the otp code every time is annoying.

8

Right — that single POST lands you on the OTP step, not past it. But for your own account you shouldn’t have to solve it every run. Two moves:

:cookie: Persist the session. Use a long-lived curl_cffi Session(impersonate="chrome") (not one-off .post), tick “trust this device” at the OTP prompt once, then pickle the cookie jar to disk and reload it next run — the device-trust cookie means no more OTP. (First check the account settings for an app password / API token — that’s the sanctioned no-OTP path for scripts.)

:key: If it’s an authenticator-app code (TOTP), generate it yourself from your own 2FA secret and post it in the second step:

import pyotp
code = pyotp.TOTP("YOUR_BASE32_SECRET").now()   # same 6 digits your app shows

You own the seed, so no phone needed. (SMS/email OTP has no clean shortcut — lean on the remember-device cookie, or read the code from your own inbox via IMAP.)