https://github.com/Mechazawa/103-early-anti-adblock Skip to content Toggle navigation Sign in * Product + Actions Automate any workflow + Packages Host and manage packages + Security Find and fix vulnerabilities + Codespaces Instant dev environments + Copilot Write better code with AI + Code review Manage code changes + Issues Plan and track work + Discussions Collaborate outside of code Explore + All features + Documentation + GitHub Skills + Blog * Solutions For + Enterprise + Teams + Startups + Education By Solution + CI/CD & Automation + DevOps + DevSecOps Resources + Learning Pathways + White papers, Ebooks, Webinars + Customer Stories + Partners * Open Source + GitHub Sponsors Fund open source developers + The ReadME Project GitHub community articles Repositories + Topics + Trending + Collections * Pricing Search or jump to... Search code, repositories, users, issues, pull requests... Search [ ] Clear Search syntax tips Provide feedback We read every piece of feedback, and take your input very seriously. [ ] [ ] Include my email address so I can be contacted Cancel Submit feedback Saved searches Use saved searches to filter your results more quickly Name [ ] Query [ ] To see all available qualifiers, see our documentation. Cancel Create saved search Sign in Sign up You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert {{ message }} Mechazawa / 103-early-anti-adblock Public * Notifications * Fork 0 * Star 50 * Detect adblockers without Javascript by abusing early hints License View license 50 stars 0 forks Branches Tags Activity Star Notifications * Code * Issues 0 * Pull requests 0 * Actions * Security * Insights Additional navigation options * Code * Issues * Pull requests * Actions * Security * Insights Mechazawa/103-early-anti-adblock This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. master BranchesTags Go to file Code Folders and files Name Name Last commit Last commit message date Latest commit History 32 Commits .github/workflows .github/workflows certs certs img img src src .gitignore .gitignore Dockerfile Dockerfile LICENSE.txt LICENSE.txt README.md README.md package-lock.json package-lock.json package.json package.json View all files Repository files navigation * README * License 103 Early Anti Adblock Proof of concept that detects adblockers without Javascript by abusing 103 Early Hints Running The application can be run either through a Docker container or directly on your machine using Node.js. Docker Using Docker simplifies the setup and ensures consistency across different environments. To launch the application in a Docker container, execute the following command: npm run docker This command wraps the process of building the Docker image and running the container. It ensures that you don't need to manually set up the environment on your local machine. Node If you prefer running the application directly on your local environment, follow these steps: Install the project dependencies using npm. npm install The application requires SSL certificates for HTTP2. npm run certs Start the application npm run serve How The core idea behind this proof of concept is the use of 103 Early Hints response. By sending early hints prior to the actual response, the server can determine whether an adblocker is present based on the client's handling of these hints. If adblock is detected, the server can then serve an alternative page. This method is particularly effective because it doesn't depend on JavaScript, which can be disabled or manipulated by users. +-------+ +------+ +-------+ +------+ |Browser| |Server| |Browser| |Server| +---+---+ +--+---+ +---+---+ +--+---+ +++ GET /index.html +++ +++ GET /index.html +++ | | ------------------->| | | | ------------------->| | | | | | | | | | | | 103 Early Hints | | | | 103 Early Hints | | | | <-------------------| | | | <-------------------| | +-----------++-+---------------------+-+---+ +-----------++-+---------------------+-+---+ | PREFETCH || | | | | | PREFETCH || | | | | +-----------+| | GET /adv.css?ABCDEF |+++ | +-----------+| | GET /adv.css?ABCDEF |+++ | | | | -------------------->| | | | | | ------------------X || | | | | | || | | | | | || | | | | | 204 No Content || |--|---+ | | | || |--|---+ | | | <--------------------| | | | | | | |+++ | | | | | |+++ | | +------------+-+---------------------+-+---+ | +------------+-+---------------------+-+---+ | | | | | +-----+-------------+ | | | | +-----+-------------+ | | | | |Prefetch timeout: | | | 200 OK | | |Resource fetched: | | | 200 OK | | |Adblock detected | | |<--------------------| | |No adblock detected| | |<--------------------| | +-------------------+ +++ +++ +-------------------+ +++ +++ +---+---+ +--+---+ +---+---+ +--+---+ |Browser| |Server| |Browser| |Server| +-------+ +------+ +-------+ +------+ Support At the moment this technique only works in Firefox. Chrome does not allow adblockers to interact with resources loaded using early hints, nor does it display resources loaded using early hints in the developer console. Additionally, Safari does not support preload early hints at all. Browsers that do not fully support early hints can be easily detected by adding a harmless dummy resource to preload that will not be blocked by adblockers. Currently, this unintended side-effect may not be a significant problem due to these factors. However, as browsers continue to expand their support for early hints, it could become a reliable method for detecting adblockers. I have previously demonstrated other techniques for detecting adblockers during the server response. Although those require a more involved implementation, they are more effective and less likely to produce false positives. Further Reading Some good resource for learning more about 103 Early Hints can be found here: * Mozilla Developer Network * Faster page loads using server think-time with Early Hints Why For evil About Detect adblockers without Javascript by abusing early hints Topics adblock anti-adblock Resources Readme License View license Activity Stars 50 stars Watchers 1 watching Forks 0 forks Report repository Languages * TypeScript 97.3% * Dockerfile 2.7% Footer (c) 2024 GitHub, Inc. Footer navigation * Terms * Privacy * Security * Status * Docs * Contact * Manage cookies * Do not share my personal information You can't perform that action at this time.