An OpenBullet config is a machine-readable workflow that tells a checker client exactly how to speak to one target: which requests to fire, in what order, what variables to extract between requests, and which response markers decide success, failure, or ban. The config format has outlived every tool rename around it — OB1 XML configs, SilverBullet's evolved dialect, Loli Stealer's fork, OD-era wizards — because the underlying anatomy never changes: a stack of card or credential data enters, a sequence of HTTP requests runs, parsing blocks extract tokens between steps, and a keycheck block classifies the final response by marker. This is the config-making decoded: the block types that compose every working config, how variables and keys actually flow, the request-response parsing patterns that survive anti-bot layers, and the settings discipline (timeouts, proxies, retries) that separates configs that return clean results from configs that only return noise.
ROUTE MAP (PLAIN ENGLISH)
Every config in every fork of this tooling family is the same five things in sequence: an input stage where the data stack enters (card|mm|yy|cvv lines, email|password combos, or whatever the target flow consumes), a request stage where HTTP calls fire against the target in order, a parsing stage where each response yields variables the next request needs (CSRF tokens, session cookies, challenge nonces, API keys embedded in page JS), a keycheck stage where the final response gets classified (success keys, fail keys, ban keys, often a captcha key as its own class), and a settings layer that wraps everything (timeouts, proxy type, redirect behavior, retries, custom user agents). A config that misses any one of these five stages either crashes, returns garbage, or silently misclassifies — and misclassification is the expensive failure because it reports dead things as live and live things as dead, which poisons every result set downstream.
The fork landscape matters less than people pretend. OB1 (the original XML format), SilverBullet (the evolution with better block tooling and ML-assisted key detection), Loli (the stealer-log-focused fork with its own config dialect), and the OD-era wizard configs all parse the same conceptual pipeline — the block names and XML schema differ, the anatomy does not. Learning the anatomy in one fork transfers to every other; learning one fork's GUI without the anatomy produces config authors who cannot debug why their keys misfire on a target that changed a single response string.
STEP 1 - THE BLOCK TYPES THAT COMPOSE EVERY CONFIG
STEP 2 - THE VARIABLE FLOW, END TO END
STEP 3 - THE REQUEST-RESPONSE PATTERNS THAT SURVIVE ANTI-BOT
STEP 4 - THE MAINTENANCE REALITY
WORKED EXAMPLE - A FIVE-STEP CONFIG MENTAL MODEL
Conceptual payment-gate flow, five blocks in order: (1) GET request to the target's payment page — parsing block extracts the CSRF token via left/right delimiters around the token input's value attribute and stores it as {CSRF}, plus a session cookie the client's jar carries forward automatically; (2) variable-assignment block composes the POST body from the stack ({cc}|{mm}|{yy}|{cvv} mapped into the gate's field names) plus {CSRF} and a generated {DEVID} that stays constant for this session; (3) POST request to the gate endpoint with the composed body, mirrored Referer/Origin headers, and the session cookie; (4) optional second GET to the status endpoint (some gates make a follow-up call whose JSON carries the authoritative payment status while the POST's HTML response is ambiguous); (5) keycheck block classifies the final JSON — ban keys checked first ("rate limited", "cf-chl", "access_denied"), then captcha keys ("grecaptcha", "hcaptcha", "turnstile"), then success keys (the status field's succeeded value), then default fail. Settings envelope: 30-second timeout, SOCKS5 proxy type, redirects followed one hop, zero retries on classified responses, rotating real user agents per session. The flow's debugging signature when it breaks: manual single-line run shows the POST carrying an empty {CSRF} — the left/right delimiters anchored on a markup attribute the target's last deploy re-ordered — fix the delimiters, results return, no other block needed changing.
WORKING SEQUENCE
QUICK ANSWERS
RELATED
Every config in every fork of this tooling family is the same five things in sequence: an input stage where the data stack enters (card|mm|yy|cvv lines, email|password combos, or whatever the target flow consumes), a request stage where HTTP calls fire against the target in order, a parsing stage where each response yields variables the next request needs (CSRF tokens, session cookies, challenge nonces, API keys embedded in page JS), a keycheck stage where the final response gets classified (success keys, fail keys, ban keys, often a captcha key as its own class), and a settings layer that wraps everything (timeouts, proxy type, redirect behavior, retries, custom user agents). A config that misses any one of these five stages either crashes, returns garbage, or silently misclassifies — and misclassification is the expensive failure because it reports dead things as live and live things as dead, which poisons every result set downstream.
The fork landscape matters less than people pretend. OB1 (the original XML format), SilverBullet (the evolution with better block tooling and ML-assisted key detection), Loli (the stealer-log-focused fork with its own config dialect), and the OD-era wizard configs all parse the same conceptual pipeline — the block names and XML schema differ, the anatomy does not. Learning the anatomy in one fork transfers to every other; learning one fork's GUI without the anatomy produces config authors who cannot debug why their keys misfire on a target that changed a single response string.
STEP 1 - THE BLOCK TYPES THAT COMPOSE EVERY CONFIG
- Request block: the HTTP call itself — method (GET/POST), URL (often with variable interpolation like {CSRF} or {APIKEY} pulled from prior parsing), request body (form-encoded or JSON, carrying the data-stack variables like {cc}, {mm}, {yy}, {cvv}), headers (User-Agent, Referer, Origin, sometimes custom anti-bot headers copied from a live browser session), and per-block settings (timeout override, redirect toggle, proxy toggle). A config with five steps has five request blocks and the order is the workflow.
- Variable assignment block: initializes or transforms variables before requests fire — pulling from the data stack ({0} for card, {1} for month in common stack formats), slicing strings, generating random values (timestamps, device IDs, UUIDs for fingerprint fields), or composing request bodies from templates. Garbage-in here produces requests that look well-formed but carry wrong data, which is the quietest failure class in config authoring.
- Parsing block (request-based parsing): extracts a value from the previous response and stores it as a variable — CSRF tokens via regex or string-left/string-right selectors, cookies via header parsing, API keys embedded in inline JavaScript, nonces from HTML data attributes. The extraction must be anchored to stable surrounding text (left/right delimiters that the target does not change between deployments); regex anchored on volatile content breaks the moment the target ships a front-end update, which is the primary maintenance tax on every long-lived config.
- Keycheck block: the classification brain — defines success keys (strings, regex, or ML-scored patterns that mean the data converted: "payment_intent succeeded", "thank you for your order", specific JSON response codes), fail keys ("card declined", "insufficient funds", "invalid card number"), ban keys ("too many requests", "access denied", "cf-chl" for Cloudflare challenge pages), and sometimes captcha keys as their own class (reCAPTCHA/hCaptcha/Turnstile markers routed to a solve-or-skip branch). Keycheck is where most misconfiguration lives: success keys anchored on generic strings that appear in fail responses too, ban keys that miss a target's custom block page phrasing, captcha keys that never fire so the config hammers a challenge page classifying every hit as fail.
- Settings layer: the envelope — timeout (seconds before a request dies; too aggressive and slow gateways read as fail, too lenient and thread pools stall on hung connections), proxy type (HTTP/SOCKS4/SOCKS5, matched to what the target's network path accepts), redirect behavior (follow or stop — following redirects through interstitial challenge pages can mask bans, stopping too early can miss the real response behind a 302), retry count (retries on network error only, never on key-classified responses — retrying a decline wastes the line and risks velocity flags), and custom user agents (rotating real strings beats a static fake; fingerprint consistency within a session matters more than realism per request).
STEP 2 - THE VARIABLE FLOW, END TO END
- Stack ingestion: the data stack arrives as lines in a fixed format — for carding configs the standard is number|mm|yy|cvv (some stacks use |name| too), for combo configs email
assword; the client's variable system maps positional fields ({0}, {1}, {2}…) or named stack entries so every downstream block references them consistently; a stack-format mismatch (yy vs yyyy, missing cvv column) produces requests with empty or malformed fields that the target rejects before any logic runs — the first debugging check, always. - Inter-request extraction: step one's response yields the token step two needs — a login request yields a session cookie the payment request must carry, a page-load request yields a CSRF token the POST body must include, a challenge-solve request yields a clearance cookie the final request must present; the parsing block's job is to capture that value robustly — left/right string extraction anchored on stable delimiters beats fragile full-match regex, and cookie extraction must handle the header's exact formatting (name=value; path=/ — value extraction stops at the first semicolon, always).
- Transformation and composition: extracted raw values rarely drop straight into the next request — timestamp variables get composed into epoch fields, device IDs get generated once and reused per-session (consistency across a session's requests), JSON bodies get assembled from templates with interpolated variables; the transformation layer is where fingerprint coherence lives: changing the device ID between two requests in one session is a detection signal no keycheck catches.
- Keycheck consumption: the final response's body, headers, and status code feed the keycheck block's marker lists — classification checks in order (ban first, then captcha, then success, then fail — ban-first ordering matters because ban pages sometimes contain the fail strings too, so a fail-first keycheck misclassifies blocks as declines); the classified result writes to the output file (live.txt, fail.txt, ban.txt, captcha.txt) that the next tool in the pipeline consumes.
STEP 3 - THE REQUEST-RESPONSE PATTERNS THAT SURVIVE ANTI-BOT
- Fingerprint coherence: one session = one identity — same user agent, same client hints, same device-ID variable, same TLS handshake characteristics (the client's proxy layer decides this); configs that randomize the UA per request while keeping the same session cookie hand anti-bot systems a ready-made anomaly: authenticated sessions do not change browsers mid-flow.
- Challenge-aware branching: Cloudflare, reCAPTCHA, hCaptcha, and Turnstile markers get their own keycheck class, routed to either a captcha-solve integration (API call to a solving service, clearance token injected into the retry) or a skip (line parked in captcha.txt for later); configs without captcha-class keys hammer challenge pages as "fail" and burn proxy reputation for nothing — the captcha key class is not optional on any target that runs bot protection.
- Header mirror discipline: the Referer/Origin/Sec-Fetch-* header set must match what a real browser navigating the flow would send — the payment POST's Referer is the page that hosted the form, the Origin matches the page's scheme+host; mismatched origin headers are cheap detection signals that cost nothing to fix and everything to ignore.
- Response-depth keycheck: the strongest success markers live in structured response data (JSON payment-status fields, API response codes) rather than page HTML — HTML strings change with every redesign; stable API response codes survive front-end rebuilds; when the target exposes both, key on the API layer and treat HTML keys as fallback only.
STEP 4 - THE MAINTENANCE REALITY
- Break cadence: any config hitting a live commercial target breaks when the target ships front-end or API changes — the expected lifespan of an unmaintained config on an active target is weeks-to-months, not years; the configs that survive longest anchor keys on API-layer responses and extract tokens from stable delimiters rather than volatile markup.
- The debugging loop: when results go all-fail, the first move is a single-line manual run with full request/response logging — confirm the stack format parsed, confirm each request carried the right variables, confirm the response actually contains the strings your success keys expect; most "broken configs" are one changed response string away from working, and the logging view shows exactly which string moved.
- Proxy-ban correlation: a config that was returning clean results shifting to all-ban usually means the proxy pool's reputation died, not that the config broke — ban-rate graphs per proxy provider tell the two failure modes apart (config break = uniform ban across all proxies; proxy death = ban concentration in specific provider ranges); mixing the two diagnoses wastes hours reworking working logic.
- Version pinning and forks: config files carry fork-version metadata — an OB1 XML config does not import cleanly into every SB build, and Loli configs carry their own dialect quirks; authoring in the fork you will run, and pinning that fork's version during maintenance sessions, avoids the migration tax that eats half a day when a silent auto-update changes block parsing.
WORKED EXAMPLE - A FIVE-STEP CONFIG MENTAL MODEL
Conceptual payment-gate flow, five blocks in order: (1) GET request to the target's payment page — parsing block extracts the CSRF token via left/right delimiters around the token input's value attribute and stores it as {CSRF}, plus a session cookie the client's jar carries forward automatically; (2) variable-assignment block composes the POST body from the stack ({cc}|{mm}|{yy}|{cvv} mapped into the gate's field names) plus {CSRF} and a generated {DEVID} that stays constant for this session; (3) POST request to the gate endpoint with the composed body, mirrored Referer/Origin headers, and the session cookie; (4) optional second GET to the status endpoint (some gates make a follow-up call whose JSON carries the authoritative payment status while the POST's HTML response is ambiguous); (5) keycheck block classifies the final JSON — ban keys checked first ("rate limited", "cf-chl", "access_denied"), then captcha keys ("grecaptcha", "hcaptcha", "turnstile"), then success keys (the status field's succeeded value), then default fail. Settings envelope: 30-second timeout, SOCKS5 proxy type, redirects followed one hop, zero retries on classified responses, rotating real user agents per session. The flow's debugging signature when it breaks: manual single-line run shows the POST carrying an empty {CSRF} — the left/right delimiters anchored on a markup attribute the target's last deploy re-ordered — fix the delimiters, results return, no other block needed changing.
WORKING SEQUENCE
Code:
config anatomy: stack input -> request blocks (order = workflow) -> variable/parse blocks (extract CSRF, cookies, API keys via stable L/R delimiters) -> keycheck (ban first, captcha class, success on API-layer markers, default fail) -> settings envelope (timeout, proxy type, redirects, no-retry-on-classified) -> fingerprint coherence: one session = one identity (UA + devid + headers consistent) -> challenge branching: captcha markers route to solve or park, never hammered as fail -> maintenance: debug via single-line full-log run, ban-rate per provider separates config break from proxy deathQUICK ANSWERS
- What is an OpenBullet config actually? A machine-readable workflow file (XML in OB1/SilverBullet dialects, fork-specific in Loli) defining the request sequence, variable parsing between steps, and keycheck classification markers for one target — the client executes it against a data stack; the anatomy (input, requests, parsing, keycheck, settings) is identical across every fork even where block names differ.
- Why do my keys always return fail? Ninety percent of all-fail runs are three causes: success keys anchored on strings the target changed in a deploy (fix: anchor on API-layer response codes, not HTML), empty variables in the POST body (fix: check the parsing block's left/right delimiters extracted the CSRF/token correctly via single-line manual run), or ban pages being classified as fail because ban keys were never defined (fix: add the target's block-page markers as ban keys checked before fail).
- What data stack format do carding configs expect? The standard is number|mm|yy|cvv pipe-delimited per line, some stacks add |name| fields; combo configs use emailassword; the positional mapping ({0}={cc}, {1}={mm}…) must match what the request blocks reference — a yy-vs-yyyy mismatch or missing cvv column produces malformed requests that die at validation before any gate logic runs, which is the first thing to verify on a fresh stack.
- Do OB1 configs work in SilverBullet or Loli? Not directly — each fork's XML schema and block names differ, though the anatomy transfers conceptually; authoring in the fork you will run avoids the migration tax, and silent fork updates occasionally change block parsing behavior, which is why version-pinning during maintenance sessions matters more than people expect.
- How long does a config survive on a live target? Weeks-to-months unmaintained on an active commercial target — front-end deploys change markup that fragile extractions and HTML-anchored keys depend on; the longest-lived configs anchor success markers on stable API response codes and extract tokens from delimiter pairs that survive redesigns, which turns most deploys into non-events and reduces maintenance to the occasional delimiters refresh.
- What is the captcha key class and why does it matter? Its own keycheck category (markers like grecaptcha, hcaptcha, cf-turnstile, cf-chl) that routes challenged lines to a solve integration or parks them in captcha.txt — without it, every challenge-page response falls through to fail, burning proxies on hammering, poisoning fail.txt with non-declines, and hiding the real solve workload from view; every config hitting a protected target needs this class defined, ban keys first, captcha second.
RELATED