go lang() Developer for @HayhaBots Forever rustling @Ecnarudne1
Jamestown (West Jimmy)
- Tweets 507
- Following 102
- Followers 4,789
- Likes 1,524
🧵 In 2021 I spent a few weeks trying to bypass Walmart's PerimeterX bot protection
by poking at their edge infrastructure.
What started as a Host header experiment in burp ended with me staring at a live internal
metrics dump from a PCI-compliant Azure production server — completely unauthenticated
And a very interesting PX bypass.
⚠️ Disclaimer: Some details are from memory so a few things may be slightly off — but the core findings are accurate.
5
119
8,146
This rabbit hole kept me busy for months and led to some of the most interesting discoveries I've ever made.
This was just one of many. I spent years researching Walmart's infrastructure, and every answer led to three more questions.
All of it fed into building Hayha — and I'd like to think that work is a big part of why it became one of the best Walmart bots ever made.
Shoutout to everyone who was along for the ride
2
6
695
The dump was from this node:
Azure | Torbit | West US | PCI zone | Edge node 01
That single unauthenticated endpoint gave me:
🔹 735 unique internal + external hostnames
🔹 756 named tenant routing configs with full plugin chains
🔹 886 unique backend origin URLs
🔹 The complete Walmart Inc. brand map
Every PerimeterX deployment. Every bot-blocking rule. Named and mapped.
The backend origins in the dump covered the entire Walmart Inc. portfolio
as of 2021:
Walmart US / CA / MX / Chile / Japan / Brazil,
Sam's Club US + MX, ASDA, George, Toyou (UK),
Jet.com CDN remnants, Vudu, Hayneedle, Bonobos,
Modcloth, Eloquii, Moosejaw, Bare Necessities,
Art.com, Bestprice India
2
3
943
Here's a quick @DICKS (DSG) bypass story:
I was tasked to work on DSG when I first came to Hayha since @LicketySpliket thought it would be great for me to prove that I can write modules & for me to gain experience. I finished the module maybe in a sub 48 hours - I was eager.
DSG introduced this new service where they would customize your sneakers for you, add text on it, you can choose colors to make it more personal BUT they did not check PIDs. It was a simple request that did not have as much Akamai protection as ATC or even start checkout.
@unrustled the king of bypasses was able to pull DSG pids (tldr; he used to use a Golf Galaxy endpoint since it was never protected by Akamai and he would brute force but we were able to get PIDs for products about 24 hours prior).
After we found out that these PIDs would directly work inside of the payload for this customize sneakers endpoint and we were able to load all the way to checkout - and in some cases checkout early. We didn't wanna make it obvious to DSG's tech team, so lickety decided to add a timer to allow people to purchase around 9:59AM EST on drop days and ladies & gentleman that's how Fast mode was born for DSG.
6
2
171
12,340
Rustler retweeted
How I helped make an extremely powerful (and consistent) Walmart bot
A thread🧵Inspired by @unreleased and everyone else hopping on the bypass boasting bandwagon
8
14
168
And yes i still have a copy rotting on a server machine in my living room which I haven't turned on in 2 years. And yes I paid nothing for both copies
3
3
2,622
Rustler retweeted
⚡️Did you hear the shocking news?
Hayha users feasted on the Adidas Confirmed App, with over 32,000+ unique checkouts logged.
Rumors suggest that there will be more new models of Yeezy dropping in the next couple of weeks.
Would you like to join us at the next feast?🤝
6
14
33
23,645