evasion-stack-guide

1# Evasion Stack Guide
2 
3Four skills cover four different layers of client impersonation. They are
4complementary, not interchangeable. Pick the lowest layer that explains the
5block, verify it fixes the response, and only then add the next layer.
6 
7## When to Use
8 
9- Requests are blocked or challenged even though the URL and method are correct.
10- A WAF/CDN returns a challenge page, 403 with no body, or a bot score wall.
11- You are unsure whether the block is IP-based, TLS-based, HTTP/2-based, or behavioral.
12 
13## Prerequisites
14 
15- Authorization for the target and an understanding of its rate limits.
16- A control request that shows *what* the block looks like (status, body, headers).
17 
18## How to Run
19 
20Diagnose the layer, then load the owning skill:
21 
22| Symptom | Layer | Skill |
23|---|---|---|
24| Block follows your IP; rotating egress changes the result | Network | `ops-proxyns` |
25| `curl` blocked but a real browser passes; block independent of headers | TLS (JA3/JA4) | `tls-fingerprint-impersonation` |
26| TLS matches but H2 frames/headers give you away (Akamai, some CF setups) | HTTP/2 | `http2-header-impersonation` |
27| Requests pass but JS challenge/fingerprint flags automation | Browser binary | `stealth-browser-launch` |
28| Page loads but interactions score as bot (reCAPTCHA v3, Turnstile) | Behavior | `humanize-automation` |
29 
30## Procedure
31 
321. **Establish the baseline.** Send the same request with `curl`, with the
33…