> ## Content Index
> Fetch the complete content index at: https://blog.pixelmelt.dev/llms.txt
> Use this file to discover other available public pages before exploring further.

# Defeating DevTools Detection
- URL: https://blog.pixelmelt.dev/defeating-devtools-detection/
- Published: 2025-07-22T04:46:44.000Z
- Updated: 2025-09-12T16:06:04.000Z
- Description: Bypassing anti-debugging detection techniques when analysing potentially malicious websites, no matter the site.
- Author: Ciarán
- Tags: web, javascript

### ⚠️ LibreWolf currently doesn't have `devtools-bypass.patch` enabled (the patch required for this to work) ⚠️

You can use this patcher I wrote which will modify your existing LibreWolf installation:

[librewolf-hotpatcher.pyGitHub Gist: instantly share code, notes, and snippets.![](https://blog.pixelmelt.dev/content/images/icon/pinned-octocat-093da3e6fa40-7.svg)Gist262588213843476![](https://blog.pixelmelt.dev/content/images/thumbnail/gist-og-image-54fd7dc0713e-1.png)](https://gist.github.com/Ciarands/be182eb4f58ae1338715e03f91010c4d?ref=blog.pixelmelt.dev)

 (slightly dangerous, may break your librewolf)

### TL;DR

You can't have a lot of features if you want a catch-all solution, DevTools are inherently pretty detectable, you need a patched browser to bypass.

1. Download [LibreWolf](https://librewolf.net/?ref=blog.pixelmelt.dev) which comes pre-patched.
2. In the search bar type `about:config`
3. Change the following settings:
- `librewolf.console.logging_disabled` to `true`
  - LibreWolf patch which detaches console API
- `librewolf.debugger.force_detach` to `true`  
  - LibreWolf patch which force detaches debuggers
- `devtools.toolbox.host` to `window`  
  - Defeats common resize detection vector
- `devtools.source-map.client-service.enabled` to `false`
  - Defeats common source mapping detection
- `webgl.disabled` to `false`  
  - Optional: Some extra evil sites detect this
- `privacy.resistFingerprinting` to `false`  
  - Optional: Some extra evil sites detect this

You should have a fully undetectable browser (although primitive, its a good initial analysis environment). 🎉

---

### Scenario

You're browsing a website, and something is seriously irritating you.

Maybe there's an annoying popup that takes you to a shady site when you click close?

Could be a big annoying window saying "Agree to sell us your soul" (accept cookies).

If you're more technical you probably figure you can just open up DevTools and delete whatever element is annoying you.

You go to open up DevTools and immediately get redirected or even worse your entire page, browser, or even ***computer*** crashes. "What? How?" You ask yourself, and go searching for an answer.

**Example of a callback which can crash a computer. (don't look at my system time ;-;)*

---

### Googling `"bypass devtools detection"` And How These Solutions Are Still Detected

So you go to search for an answer, and are greeted with thousands of results. Lets take a look at the top 4 search results, each of these, while many good; are still vulnerable to a number of detection vectors due to the nature of how they're designed.

Here's a simple check I made for this article which will detect all of these scripts. This detection follows a similar principle to timing-based detection's when logging a large amount of data using `console.table`:

```js
function checkTimingDelay() {
  const error = new Error("Error for timing test");
  const start = performance.now();
  for (let i = 0; i < 35000; i++) {
    console.error(i, error.stack);
    // "i" prevents some browsers from folding errors causing it to have to render each time,
    // when devtools are open or "error" is tampered with, it will cause a significant difference in timing
  }
  const end = performance.now();
  return end - start;
}
```

![](https://blog.pixelmelt.dev/content/images/2025/07/-4E85D44E-C097-4B8A-BEEB-4BC64FE5E820-.png)

Default state of our detection

**1) Bypass disable-devtool Github Gist**

[Bypass disable-devtoolBypass disable-devtool. GitHub Gist: instantly share code, notes, and snippets.![](https://blog.pixelmelt.dev/content/images/icon/pinned-octocat-093da3e6fa40-4.svg)Gist262588213843476![](https://blog.pixelmelt.dev/content/images/thumbnail/gist-og-image-54fd7dc0713e.png)](https://gist.github.com/aravindanve/3e13d995fac35e4a07c236b11cc432c7?ref=blog.pixelmelt.dev)

This is often your first search result result. However, if you're being detected by anything other than [*theajack's disable-devtool*](https://github.com/theajack/disable-devtool?ref=blog.pixelmelt.dev) this probably wont help.

It is still very good for the specific script it targets, utilizing a clever solution with [*javascript url's*](https://developer.mozilla.org/en-US/docs/Web/URI/Reference/Schemes/javascript?ref=blog.pixelmelt.dev): `javascript:DisableDevtool.isSuspend = true`

**2) Bypass DevTools Detection UserScript**

[Bypass DevTools DetectionPrevent websites from detecting DevTools (Inspect Element) is open![](https://blog.pixelmelt.dev/content/images/icon/blacklogo16-DftkYuVe.png)Cristion Kjeldgard (Frisk)![](https://blog.pixelmelt.dev/content/images/thumbnail/blacklogo96-CxYTSM_T.png)](https://greasyfork.org/en/scripts/534968-bypass-devtools-detection?ref=blog.pixelmelt.dev)

This is a more recent UserScript, it should bypass most detection's you'll run into. However it will still immediately be detected by our check due to this offending snippet:

```js
// Override console methods to disable traps and weird behaviors
['log', 'debug', 'error', 'info', 'warn'].forEach(method => {
    const originalMethod = console[method];
    console[method] = function(...args) {
        // Skip logging if args include certain trap images or weird data (optional)
        for (const arg of args) {
            if (arg instanceof Image) return;
        }
        return originalMethod.apply(console, args);
    };
});
```

The modification of the `error` method leads to a significant delay clearly signifying tampering has occurred.

![](https://blog.pixelmelt.dev/content/images/2025/07/-A870C155-C1A5-48FB-B576-CC9839CA9CAD-.png)

Tampering detected.

![](https://blog.pixelmelt.dev/content/images/2025/07/-5229964C-F0C1-44A9-86B4-C82CD35D4A95-.png)

Site functions normally when targeted function isn't being tampered with.

It has a few more detection vectors and mistakes, such as attempting to no-op non existent properties:

```js
// --- Override debugger to noop ---
window.debugger = function() {};

```

`debugger` is a reserved keyword; not a property or method of the `window` object, a `typeof` check would flag this.

**3) Anti-anti debug extension**

[Anti Anti Debug - Chrome Web StoreBe able to use developer tools again![](https://blog.pixelmelt.dev/content/images/icon/icon_144px.png)Chrome Web Store![](https://blog.pixelmelt.dev/content/images/thumbnail/QG2w9thm4entJ7WOxsmbQ89sCwGxbZS8h3fqb6uCtbrLNv-xc9gqvB-BKeh5n6NoZT10WhDEWcOXsMMrI4Mnu2G9-s128-rj-sc0x00ffffff)](https://chromewebstore.google.com/detail/anti-anti-debug/mnmnmcmdkigakhlfkcdimghndnmomfeo?ref=blog.pixelmelt.dev)

This popular extension is good, but quite outdated and very vulnerable to a number of modern detection vectors.

![](https://blog.pixelmelt.dev/content/images/2025/07/-1894C05A-3A32-4CC6-BF41-EF29B78AC5AC-.png)

Not flagged immediately with install.

![](https://blog.pixelmelt.dev/content/images/2025/07/-E5EAB7A4-0884-4F1F-9884-67DCE8C9B82B-.png)

Flagged on DevTools open due to significant delay rendering 35k errors.

**4) How to prevent websites from detecting the dev console? - Reddit**

You may even see [Reddit posts](https://www.reddit.com/r/browsers/comments/rpvlpn/how%5Fto%5Fprevent%5Fwebsites%5Ffrom%5Fdetecting%5Fthe%5Fdev/?ref=blog.pixelmelt.dev), claiming its impossible!

"Conclusion: **It is** ***NOT*** **possible**. This question has been asked for many years and no solution has yet been found that is not specific to the website." - u/coomerpile (😭)

This isn't true, but a lot of the replies are unhelpful.

---

### A True Solution To Becoming Undetected

You may think its hopeless, how are you even supposed to manually patch a malicious script if you're crashing before you can even add the override? What if its obfuscated and you can't easily override it?

The problem is, we've been fighting on the wrong battlefield. All the solutions we've looked at; extensions and scripts, are trying to patch the problem from the inside. Like trying to stop a leak from inside a submarine with duct tape. The browser itself is telling on you.

Every standard browser (Chrome, Firefox, Safari, ect) is built with developers in mind. APIs such as `console` are a deeply integrated property of the `window` object. There's honestly too much to consider when attempting to perfectly mirror the behavior of closed DevTools.

For example, in recent history, a malicious script could define properties on certain objects, and if you opened DevTools, you would be detected.

```js
const err = new Error();
Object.defineProperty(err, 'stack', {
  get() {
    console.log("You're detection. :( ")
  }
});
console.log(err);

```

[https://datadome.co/threat-research/how-new-headless-chrome-the-cdp-signal-are-impacting-bot-detection/](https://datadome.co/threat-research/how-new-headless-chrome-the-cdp-signal-are-impacting-bot-detection/?ref=blog.pixelmelt.dev)

This was finally fixed in [**d435f290e382f0296f647016cb5d70d54eca3fd8** ](https://chromium.googlesource.com/v8/v8/+/d435f290e382f0296f647016cb5d70d54eca3fd8%5E%21/?ref=blog.pixelmelt.dev#:~:text=commit%20d435f290e382f0296f647016cb5d70d54eca3fd8,diff)(April 4, 2024)

However this doesn't by any means mean that this form of attack is closed, this specifically has been solved, but there are still a number of properties that are accessed in such a way that they provide a reliable detection vector.

The only real solution is to use a browser where these "features" are either fundamentally broken or completely ripped out. We need a browser that has been patched before it was even compiled.

---

### LibreWolf Enters

For those unfamiliar, LibreWolf is a fork of Firefox which is hyper-focused on privacy and security. It comes pre-packaged with a bunch of modifications and patches designed to prevent tracking and fingerprinting.

First, go and download it here:

[LibreWolf BrowserA custom version of Firefox, focused on privacy, security and freedom.![](https://blog.pixelmelt.dev/content/images/icon/icon.svg)LibreWolf![](https://blog.pixelmelt.dev/content/images/thumbnail/og_image.png)](https://librewolf.net/installation/?ref=blog.pixelmelt.dev)

### Configuration

We need to tweak some of LibreWolf's settings. To do this, we'll use Firefox's configuration editor.

In the search bar, type `about:config` and press Enter. You'll see a warning page. Click "Accept the Risk and Continue"

![](https://blog.pixelmelt.dev/content/images/2025/07/-C73FFE45-7FF9-428D-AA91-4EFEEB085337-.png)

You're going to want to use the search bar at the top of this page to find and change the following settings.

**1) Stop Handling Console API**

- **Setting:** `librewolf.console.logging_disabled`
- **Change to:** `true`

This is a custom patch included in LibreWolf that guts the console. It modifies `onConsoleAPILogEvent` in `resource://devtools/server/actors/webconsole/listeners/console-api.js` adding this check:

![](https://blog.pixelmelt.dev/content/images/2025/07/image-2.png)

Internally this will act as if there is no handler for a received object from the `ConsoleAPIStorage` service. In the eyes of the `console` API this *should* perfectly mimic the behavior of not having DevTools open at all.

**2) Force-Detach Debuggers**

- **Setting:** `librewolf.debugger.force_detach`
- **Change to:** `true`

Another LibreWolf-specific patch. It modifies `attach` in `resource://devtools/server/actors/thread.js` adding this check:

![](https://blog.pixelmelt.dev/content/images/2025/07/image-2-1.png)

Internally, this will hit the same early return condition that `this.alreadyAttached` triggers, blocking all detection vectors from the Debugger tab (another surface for a timing-based side-channel attack) and preventing the `debugger` keyword from being handled, avoiding all debugger traps.

```js
const start = performance.now();
debugger;
const end = performance.now();
if (end - start > 100) { 
  triggerAntiTamper();
}
```

Example of a debugger trap.

![](https://blog.pixelmelt.dev/content/images/2025/07/Serving-Up-Tycoon-2FAs-Secrets-Figure11.png)

Phishing webpage malware sample which abuses debugger traps as an anti-analysis technique, redirecting on detection. Credit: [https://www.esentire.com/blog/phish-chips-serving-up-tycoon-2fas-secrets](https://www.esentire.com/blog/phish-chips-serving-up-tycoon-2fas-secrets?ref=blog.pixelmelt.dev)

**3) Defeat Resize Detection**

- **Setting:** `devtools.toolbox.host`
- **Change to:** `window`

One of the oldest tricks in the book. When you open DevTools, it's typically docked to the side or bottom of your browser, which changes the size of the main viewport. Scripts can have a listener that just waits for the window to be resized. If it resizes past a certain threshold instantly, it’s a dead giveaway that DevTools are open.

By changing this setting from `side` to `window`, you tell the browser to open DevTools in a completely separate window. This way, the original webpage's viewport size never changes.

**4) Defeat Source Mapper**

- **Setting:** `devtools.source-map.client-service.enabled`
- **Change to:** `false`

Source maps are supposed to help developers debug minified or transpiled code by mapping it back to the original source. Some anti-devtools scripts work by requesting a non-existent source map file. When you open DevTools, the browser automatically tries to fetch this file, and the website's server logs the request, flagging you instantly. By disabling this, your browser won't try to fetch those files.

[Javascript Anti Debugging - Abusing SourceMappingURLAbusing SourceMappingURL feature can allow attackers to create one of the strongest Cross Browsers Javascript Anti Debugging techniques![](https://blog.pixelmelt.dev/content/images/icon/apple-touch-icon-144-precomposed.png)Gal WeizmanGal Weizman![](https://weizman.github.io/content/img/previews/)](https://weizmangal.com/page-js-anti-debug-1/?ref=blog.pixelmelt.dev#:~:text=,before%20we%20start)

### Optional Tweaks for Extra Evil Sites

The settings above will get you past anti-DevTools scripts. However, some particularly nasty sites use broad fingerprinting techniques which can cause LibreWolf itself to become detected. Some of LibreWolf's defaults can sometimes be a bit too unique. If you're still having trouble, consider relaxing these two settings.

- **Setting:** `webgl.disabled`
- **Change to:** `false`
  - **Why:** LibreWolf disables WebGL by default for privacy. However, so few users have it disabled that its absence can be a fingerprint. Enabling it makes you look more like a standard user.
- **Setting:** `privacy.resistFingerprinting`
- **Change to:** `false`
  - **Why:** This is Firefox's built-in "Tor-Uplift" mode. It standardises many things to make you blend in with other privacy-conscious users. Ironically resisting fingerprinting has become a fingerprint itself. Disabling this can, paradoxically, make you less conspicuous.

---

### Celebrate Being Undetected! 🎉

Test your detection here:

[devtools-detector demo![](https://blog.pixelmelt.dev/content/images/icon/faviconV2)](https://blog.aepkill.com/demos/devtools-detector/?ref=blog.pixelmelt.dev)

Even our demo cant catch us! 🎉

---

### Contact

If you find a site which manages to avoid all this and still detects your DevTools, I'd love to hear about it, reach out to me at: [ciaran@exploit.cat](mailto:ciaran@exploit.cat)