xvertile/akamai-bmp-generator

Generate sensor data for Akamai's Bot Management Protocol (BMP) to bypass bot detection.

Akamai BMP Generator

Generate sensor data for Akamai's Bot Management Protocol (BMP) to bypass bot detection.

Original creator https://github.com/ui0x

The Akamai BMP Generator is a fully reversed implementation of Akamai's BMP (Bot Management Protocol). This tool is designed for educational and research purposes, providing insights into various versions of Akamai BMP.

Features

• ✅ Proof of Work (PoW) support

• ✅ Easy to use interface

• ✅ 2K unique device fingerprints included

• ✅ fast

• ✅ Made in goLang

• ✅ Support for multiple Akamai BMP versions:

  • 3.3.4
  • 3.3.1
  • 3.3.0
  • 3.2.3
  • 3.1.0
  • 2.2.3
  • 2.2.2
  • 2.1.2

Usage

Command line arguments:

  --host string
        Hostname to listen on (default localhost)
  --port string
        Port to listen on (default 1337)
  --devicepath string
        Path to device fingerprints (default "devices.json")

1. git clone https://github.com/xvertile/akamai-bmp-generator.git
2. cd akamai-bmp-generator/server
3. go run main.go

Additional Information

By default the server will use devices.json as the device fingerprint file. This file contains 1000 unique device fingerprints. If you want to use your own device fingerprints, you can use the --devicepath argument to specify a different file.

Screenshots

Example

Example of a request to the server check examples/example.go for the full example.

func getbmp(client tls_client.HttpClient) ResponseData {
	req, err := http.NewRequest(http.MethodPost, "http://127.0.0.1:1337/akamai/bmp", strings.NewReader("{\"app\": \"com.ihg.apps.android\",\"lang\": \"en\",\"version\": \"3.3.4\"}"))
	if err != nil {
		log.Println(err)
	}
	resp, err := client.Do(req)
	if err != nil {
		log.Println(err)
	}
	defer resp.Body.Close()
	if err != nil {
		fmt.Errorf("error executing request: %w", err)
	}
	defer resp.Body.Close()

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		fmt.Errorf("error reading response body: %w", err)
	}

	var responseData ResponseData
	err = json.Unmarshal(body, &responseData)
	if err != nil {
		fmt.Errorf("error unmarshalling response JSON: %w", err)
	}
	return responseData
}

akamai-bmp-generator's Issues

africans

...

(untyped int constant) as int value in array or slice literal (overflows)

Don't building. Can you fix it? Thx!

..\sdk\sdk.go:37:22: cannot use 3523407757 (untyped int constant) as int value in array or slice literal (overflows) ..\sdk\sdk.go:37:34: cannot use 2768625435 (untyped int constant) as int value in array or slice literal (overflows) ..\sdk\sdk.go:37:70: cannot use 3580832660 (untyped int constant) as int value in array or slice literal (overflows) ..\sdk\sdk.go:37:82: cannot use 2724731650 (untyped int constant) as int value in array or slice literal (overflows) ..\sdk\sdk.go:37:117: cannot use 3705235391 (untyped int constant) as int value in array or slice literal (overflows) ..\sdk\sdk.go:37:129: cannot use 2883475241 (untyped int constant) as int value in array or slice literal (overflows) ..\sdk\sdk.go:37:164: cannot use 3686048678 (untyped int constant) as int value in array or slice literal (overflows) ..\sdk\sdk.go:37:176: cannot use 2897449776 (untyped int constant) as int value in array or slice literal (overflows) ..\sdk\sdk.go:37:211: cannot use 3484811241 (untyped int constant) as int value in array or slice literal (overflows) ..\sdk\sdk.go:37:223: cannot use 3098726271 (untyped int constant) as int value in array or slice literal (overflows)

Bit late for a skid mate...

Happy to share 3.3.5 with you if you want to include that in your "improved version" of our code lol.

Love it.

Can you share 3.3.5?

Can you update akamai bmp3.3.5? Thank you！！！

question

hi friend, can you share your email or Telegram ID?
do you have web version?

Converting code for bmp version 3.3.6

Hi, I am working with an APK that makes use of Akamai bmp version 3.3.6.
I would be able to extract the RSA encrypt key from the .so file but I'm wondering if that might be the only difference between for example a 3.3.4 and a 3.3.6 version?
They probably also change something in the structure of the sensordata I would suppose, do you know more about this?

3.3.4 not working

3.3.4 invalid sensor

_

Do you offer paid consulting services?

Hi.

I want to scrape data from a Android APP and the APP is protected by akamai bmp .

I tried to generate a x-acf-sensor-data by akamai-bmp-generator, it worked very well (I can get the data and the request was not blocked by akamai) .

But 10 hours later, all of the requests are blocked by akamai (the status code is 403 ).

Could you help me to solve the problem?

If you can help solve it, we would like to paid for it.

Thank You.

Help / guidance needed for the post data request to the local host

Good evening,
Just wondering if your able to give me some information regarding the post data request that is issued to the local host.
In the example photo you have the following
{
"app": "com.hilton.android.hhonors",
"lang": "en",
"version": "3.3.4",
"challenge": true,
"powurl": "https://m.hilton.io
}
I'm aware of how to see the current BPM the website is using
however where do you find the actual post data required for the sensor data response?
Does the apk need to be decompiled and searched through to see what is being sent to the generate sensor data function.

Sorry for the long explanation very keen to learn, just struggling with where to find the actual post data information needed to generate the successful sensor data

Advice on akamai bmp generation using frida

Hi,

I tried generating akamai headers from an apk that uses version 3.3.6.
Using Frida I hooked the function to retrieve an akamai header so I let the app do all the work and wanted to harvest some headers. I then let it call this function continuously.
This worked in a way but the problem that occurred is that the headers got longer in length every time I called the function. After a while they got so long that they were to long for a requestbuffer.
Do you have any idea why this length systematically increases?

device fingerprint generator

Is it possible have also the code to generate the fingerprint of devices?

2.2.3 doesn't work

The 2.2.3 version is giving a parameter mismatch. After analysing the script I found it had another field named as prefix. Could you please give an example input for this?