# \[HELP\] Bulding Script or .Exe

**URL:** <https://onehack.st/t/help-bulding-script-or-exe/322699>\
**Category:** Discussion & Solutions\
**Tags:** solved\
**Created:** [June 3, 2026, 7:08pm UTC](https://onehack.st/t/help-bulding-script-or-exe/322699 "2026-06-03T19:08:43Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Guile](https://onehack.st/user_avatar/onehack.st/guile/32/170764_2.png) [@Guile](https://onehack.st/u/Guile)\
**Post date:** [June 3, 2026, 7:08pm UTC](https://onehack.st/t/help-bulding-script-or-exe/322699/1 "2026-06-03T19:08:43Z")

</div>

"Hello Onehack community, I’m having trouble with my code and I need some help.  
I am programming a Python script with a login function for a specific website, and it uses Selenium. Can you give me some tips or a way to achieve this? I already have the basic structure. Please?! Thanks for atectiON  
(coding in anexe) thanks Utilize Selenium  
[habbo.txt](https://onehack.st/uploads/short-url/u893t89VBORzEniRTe1OXr79bEc.txt) (5.4 KB)

---

<div class="post-metadata">

**Author:** ![Abd\_Shk](https://onehack.st/user_avatar/onehack.st/abd_shk/32/25814_2.png) [@Abd\_Shk](https://onehack.st/u/Abd_Shk)\
**Post date:** [June 3, 2026, 7:33pm UTC](https://onehack.st/t/help-bulding-script-or-exe/322699/2 "2026-06-03T19:33:48Z")

</div>

[Selenium login flow.txt](https://onehack.st/uploads/short-url/8zTAvq1CjVVpJPS8wexjQESC5Vw.txt) (867 Bytes)  
[practical Selenium.txt](https://onehack.st/uploads/short-url/ebsg6BoaI9jWZWGsRhDpQa2ubhS.txt) (857 Bytes)

Try

---

<div class="post-metadata">

**Author:** ![zboutsam](https://onehack.st/user_avatar/onehack.st/zboutsam/32/168229_2.png) [@zboutsam](https://onehack.st/u/zboutsam)\
**Post date:** [June 3, 2026, 7:43pm UTC](https://onehack.st/t/help-bulding-script-or-exe/322699/3 "2026-06-03T19:43:08Z")

</div>

You could also switch from Selenium to Playwright. It’s faster and overall better

---

<div class="post-metadata">

**Author:** ![Guile](https://onehack.st/user_avatar/onehack.st/guile/32/170764_2.png) [@Guile](https://onehack.st/u/Guile)\
**Post date:** [June 4, 2026, 6:34pm UTC](https://onehack.st/t/help-bulding-script-or-exe/322699/4 "2026-06-04T18:34:55Z")

</div>

@Abd_Shk

### Corpo da Postagem:

**Hello OneHack Community,**

I’ve been deep in the trenches of web automation lately, dealing with the usual friction: WAFs, behavioral analysis, and the inevitable “cat and mouse” game with anti-bot providers. Many developers rely on basic Selenium setups or bloated extensions, which are the first things to get flagged by modern fingerprinting engines.

I wanted to share a shift in methodology that I’ve been calling the **“Apogeu” Protocol** —a zero-dependency, stealth-first architecture for scaling web automation.

**The Problem with Standard Automation:** Most scripts are transparent because they carry the “bot signature” from the start. Plugins like `stealth` are good, but they are generic. If the site checks your hardware concurrency, WebGL renderer, or `navigator.webdriver` flags, you’re burnt before you even reach the login screen.

**The “Apogeu” Architecture:**

1. **Polymorphic Identity (The DNA):** Instead of one static config, the engine uses a `fingerprints.json` library. Every “battery” of operations pulls a completely new identity (DeviceMemory, hardware concurrency, platform) and injects it via **Chrome DevTools Protocol (CDP)** _before_ the DOM is even painted.

2. **Digital Amnesia:** We don’t just clear cookies. We perform a deep purge (LocalStorage, SessionStorage, and context refresh) between cycles. By treating every batch as a new entity, we break the correlation logic used by behavioral trackers.

3. **CDP Injection vs. JS Injection:** We skip the overhead of page-load extensions. We talk directly to the Chromium engine.

**The Result:** A setup that is virtually indistinguishable from a regular user, running in a headless Docker environment with zero external dependencies. No heavy “Anti-Detect” browsers, just pure, native Chromium control.

[1.zip](https://onehack.st/uploads/short-url/wBi9B7OWi2fbXxLW7agLMywsM8w.zip) (15.6 KB)

---

<div class="post-metadata">

**Author:** ![zboutsam](https://onehack.st/user_avatar/onehack.st/zboutsam/32/168229_2.png) [@zboutsam](https://onehack.st/u/zboutsam)\
**Post date:** [June 4, 2026, 11:18pm UTC](https://onehack.st/t/help-bulding-script-or-exe/322699/5 "2026-06-04T23:18:01Z")

</div>

“Apogeu” Protocol is good for marketing. I say this because this is all Automation 101. Industry standard practises when it comes to automation and web scraping. So far, depending on your needs ofc, you have a very good setup got web scraping. In my opinion, back in the day, in order to code one should have known how to, but nowadays we can make a perfect end result of a script for web scraping. Now with AI, you don’t need to have the knowledge, just write really detailed and in depth prompts of what you want to do or fix.

---

<div class="post-metadata">

**Author:** ![SRZ](https://onehack.st/user_avatar/onehack.st/srz/32/146132_2.png) [@SRZ](https://onehack.st/u/SRZ)\
**Post date:** [July 30, 2026, 3:15pm UTC](https://onehack.st/t/help-bulding-script-or-exe/322699/6 "2026-07-30T15:15:54Z")

</div>

Here’s the thing your “Apogeu” writeup is quietly proving: you’re **hand-building tools that already exist, done better.** Plain Selenium can’t win — beyond `navigator.webdriver` it _must_ emit a `Runtime.enable` CDP call, and that single signal is exactly what DataDome/Cloudflare fingerprint. No `fingerprints.json` or CDP injection can hide it. So stop patching. Pick a lane 👇 _(all of this is for automating an account you’re allowed to — your own / an authorized one.)_

**🥷 Lane 1 — swap Selenium for a browser that’s stealth by construction**  
These _are_ your Apogeu, built right — no webdriver surface to patch in the first place:

- 🔁 **[patchright](https://github.com/Kaliiiiiiiiii-Vinyzu/patchright-python)** — drop-in Playwright, _change one import._ Kills the `Runtime.enable` leak a patch physically can’t (runs JS in isolated contexts). Easiest upgrade if you keep Playwright. → `pip install patchright && patchright install chromium`
- 🧬 **[nodriver](https://github.com/ultrafunkamsterdam/nodriver)** — the author’s own successor to undetected-chromedriver. **No Selenium, no chromedriver** → the `$cdc_`/webdriver fingerprint never exists. One import replaces your Selenium + driver + CDP-injection code; `tab.cf_verify()` clears Turnstile. → `pip install nodriver`
- 🦊 **[camoufox](https://github.com/daijro/camoufox)** — your `fingerprints.json` done right: spoofs navigator/WebGL/audio/fonts/WebRTC at the **C++ level** (invisible to JS prop-inspection) and rolls a fresh realistic fingerprint _per launch_. → `pip install -U camoufox[geoip] && camoufox fetch`

**⚡ Lane 2 — you might not need a browser at all** _(the move nobody in the thread mentioned)_  
If the login is a form POST, the real wall isn’t JS — it’s the **TLS/JA3 handshake**. Forge that and a plain HTTP request logs in:

1. Chrome **DevTools → Network** → do your login once → right-click the login POST → **Copy → Copy as cURL**.
2. Paste into **[curlconverter](https://github.com/curlconverter/curlconverter)** → out comes Python.
3. Swap `requests` for **[curl\_cffi](https://github.com/lexiforest/curl_cffi)** and add `impersonate="chrome"`:

```python
import curl_cffi
r = curl_cffi.post("https://site/api/login",
                   json={"user": u, "pass": p}, impersonate="chrome")

```

→ ~50 ms per login, no Chromedriver, no fingerprint file, and it compiles to a **tiny** exe.

**📦 Lane 3 — turn it into a clean `.exe`**

- 🏗 **[Nuitka](https://github.com/Nuitka/Nuitka)**, not PyInstaller. It’s a _real compiler_ (Python → C → machine code): far fewer antivirus false-flags, and nobody can unpack your source (a PyInstaller `.exe` opens with `pyinstxtractor` in seconds).

```auto
python -m nuitka --standalone --onefile --windows-console-mode=disable login.py

```

↳ Bundling a browser? add `--enable-plugin=playwright --playwright-include-browser=chromium` (or skip it and drive the user’s own Chrome).

- 🖱 **[Botasaurus Desktop](https://github.com/omkarcloud/botasaurus-desktop-starter)** — want a _clickable app_ instead of a console exe? It wraps a stealth (undetected + anti-fingerprint) scraper in a real UI + Windows installer. `npm run package`.

> **🧰 The full stealth + build stack — 10 more, for edge cases**
>
> **Stay on Selenium’s muscle memory:** [SeleniumBase](https://github.com/seleniumbase/SeleniumBase) `SB(uc=True)` UC/CDP mode (disconnects webdriver during bot checks) · [selenium-driverless](https://github.com/kaliiiiiiiiii/Selenium-Driverless) · [undetected-chromedriver](https://github.com/ultrafunkamsterdam/undetected-chromedriver) (legacy, use nodriver instead).  
> **CDP-native controllers:** [DrissionPage](https://github.com/g1879/DrissionPage) (12k★, mixes HTTP + browser; CN docs) · [zendriver](https://github.com/cdpdriver/zendriver) (maintained nodriver fork).  
> **No-browser TLS clients:** [primp](https://github.com/deedy5/primp) (simplest Rust one) · [wreq](https://github.com/0x676e67/wreq-python) (JA4 + Chrome149) · [tls-client](https://github.com/FlorianREGAZ/Python-Tls-Client) (utls, fallback).  
> **Hybrid:** [hrequests](https://github.com/daijro/hrequests) — HTTP path, `.render()` promotes the _same_ session into a stealth browser only when a JS challenge hits.  
> **JS-evasion add-on:** [playwright-stealth](https://pypi.org/project/playwright-stealth/) v2 (`Stealth()` context manager).  
> **Exe helpers:** [Selenium Manager](https://www.selenium.dev/documentation/selenium_manager/) auto-fetches the matching driver (drop `--add-binary`) · PyInstaller if you must — the fix for these libs: `pyinstaller --onefile --collect-all curl_cffi --hidden-import _cffi_backend` (it drops the DLL + cacert.pem otherwise).

_The bot signature isn’t something you hide — it’s something you never emit. Delete the driver, not the fingerprints._

---

<div class="post-metadata">

**Author:** ![zboutsam](https://onehack.st/user_avatar/onehack.st/zboutsam/32/168229_2.png) [@zboutsam](https://onehack.st/u/zboutsam)\
**Post date:** [July 31, 2026, 12:21pm UTC](https://onehack.st/t/help-bulding-script-or-exe/322699/7 "2026-07-31T12:21:05Z")

</div>

In Lane 2, ‘‘import curl\_cffi  
r = curl\_cffi.post(“[https://site/api/login](https://site/api/login)”,  
json={“user”: u, “pass”: p}, impersonate=“chrome”)’’ if the site asks for an OTP code after the login, I guess that does not work, right?

I am an authorized user of the account, but requesting the otp code every time is annoying.

---

<div class="post-metadata">

**Author:** ![SRZ](https://onehack.st/user_avatar/onehack.st/srz/32/146132_2.png) [@SRZ](https://onehack.st/u/SRZ)\
**Post date:** [July 31, 2026, 12:38pm UTC](https://onehack.st/t/help-bulding-script-or-exe/322699/8 "2026-07-31T12:38:23Z")

</div>

Right — that single POST lands you **on** the OTP step, not past it. But for your own account you shouldn’t have to solve it every run. Two moves:

🍪 **Persist the session.** Use a long-lived **`curl_cffi` `Session(impersonate="chrome")`** (not one-off `.post`), tick **“trust this device”** at the OTP prompt once, then pickle the cookie jar to disk and reload it next run — the device-trust cookie means no more OTP. _(First check the account settings for an **app password / API token** — that’s the sanctioned no-OTP path for scripts.)_

🔑 **If it’s an authenticator-app code (TOTP)**, generate it yourself from your own 2FA secret and post it in the second step:

```python
import pyotp
code = pyotp.TOTP("YOUR_BASE32_SECRET").now() # same 6 digits your app shows

```

You own the seed, so no phone needed. _(SMS/email OTP has no clean shortcut — lean on the remember-device cookie, or read the code from your own inbox via IMAP.)_