Bot Demo 2: Silent Discard

Demo 2

🎯 Demo Purpose

Demonstrates the Silent Discard technique: bot-submitted comments are stored with a hidden flag and never shown to real users, while the bot receives a success response. The bot believes its spam worked and does not escalate.

🔧 How It Works

1

Comment Submitted

A user or bot submits a comment through the form.

2

Bot Determination

The server reads the x-amzn-waf-bot-targeted header. A non-empty value means the request is from a bot.

3

Conditional Storage

Bot comments are stored with silent_discard=1; human comments with silent_discard=0. Both get the same HTTP success response.

4

Selective Display

Regular users only see silent_discard=0 comments. When the bot re-fetches the page, it sees its own comment — reinforcing the illusion of success.

💡 Benefits of Silent Discard

🕵️

Bot Deception

Bots believe their spam worked and do not attempt evasion or escalation.

🛡️

User Protection

Real users never see spam comments in their feed.

📊

Data Collection

Discarded comments remain in the DB for bot behavior analysis.

⚡

Prevents Adaptation

Identical HTTP responses and page output leave no signal that the bot was detected.

⚙️ Server Code (Core Logic)

Comment Storage

app.post('/bot-demo-2', (req, res) => {
    const { commenter, details } = req.body;
    // isBot = x-amzn-waf-bot-targeted is non-empty (WAF header contract)
    const isBot = isBotRequest(req);
    const silentDiscard = isBot ? 1 : 0;

    db.run(
        'INSERT INTO tbl_comments (commenter, details, silent_discard) VALUES (?, ?, ?)',
        [commenter, details, silentDiscard],
        function(err) {
            if (err) return res.status(500).send('Database error');
            res.redirect('/bot-demo-2'); // same response for bots and humans
        }
    );
});

Comment Retrieval

app.get('/bot-demo-2', (req, res) => {
    const isBot = isBotRequest(req);

    // Bots see ALL comments (including their own spam)
    // Humans see only silent_discard=0 comments
    let query = 'SELECT * FROM tbl_comments WHERE silent_discard = 0 ORDER BY created_at DESC';
    if (isBot) query = 'SELECT * FROM tbl_comments ORDER BY created_at DESC';

    db.all(query, [], (err, rows) => {
        res.render('bot-demo-2', { comments: rows, isBot });
    });
});

🚀 Run the Demo

Try the comment system yourself. Compare what a bot sees versus what a regular user sees.

Run Demo 2

💡 How to Experience

  • Submit a comment from a regular browser.
  • Submit with an automation tool — the comment is stored with silent_discard=1.
  • The bot comment is invisible to regular browser users.
  • The bot re-fetching the page will see its own comment, confirming the deception.