Patched - Githubissues

l10r commented 3 years ago

Apparently the solver just got patched.

awxlfy commented 3 years ago

@dinohorvat I'm using what @nayde-fr suggested above to return n and c as an array:

async function getCode(host, sitekey) {

  let response = (await axios.get(`https://hcaptcha.com/checksiteconfig?host=${host}&sitekey=${sitekey}&sc=1&swa=1`)).data;

  const browser = await puppeteer.launch({
      headless: true,
      args: [`--window-size=600,1000`, '--window-position=000,000',  '--disable-dev-shm-usage', '--no-sandbox', '--user-data-dir="/tmp/chromium"', '--disable-web-security', '--disable-features=site-per-process']

  });

  const [page] = await browser.pages();
  await page.addScriptTag({url: 'https://assets.hcaptcha.com/c/f1430c5c/hsw.js'});
  let hswResponse = await page.evaluate(response => hsw(response.c.req), response);
  return [hswResponse, response['c']];
}

My host and sitekey are passed in from what I parsed out of the iframe on the page (so its dynamic based on any page that shows an hcaptcha). I'm then creating my data using the parsed sitekey and host as well as the n and c value I just recieved:

let data = {
  sitekey: urlParams.get('sitekey'),
  host: urlParams.get('host'),
  n: hswResponse[0],
  c: JSON.stringify(hswResponse[1]),
  v: 'f1430c5c'
}

As for my /getcaptcha call:

let response = await request('https://hcaptcha.com/getcaptcha', {
  method: 'post',
  json: true,
  form: data
});

dinohorvat commented 3 years ago

@aw1875 This import https://assets.hcaptcha.com/c/f1430c5c/hsw.js is different for every host (At least what I've noticed). So you should go to the host website and check which hsw.js is being accessed. I'm pretty sure its different than f1430c5c. Once you get the correct version, apply it to your code.

awxlfy commented 3 years ago

@dinohorvat Didn't even think of that. I just gave that a try but still got the same type of message back. 'bypass-message': 'No bypass_token found.' Is still at the very end.

dinohorvat commented 3 years ago

@aw1875 It could be that your IP is blacklisted. Try accessing the host website and try to login. If hcaptcha puzzle pops up then your only solution to unblock it and be able to use the script, is to solve it few times manually (or use 2captcha with proxy to your IP). Another solution is to use multiple proxies, so when one fails just use another one. I suggest you start playing with it and see how it behaves, that's how I managed to get my solution working.

Also feel free to send me the site key and host and I will try it with my solution to see if it works.

awxlfy commented 3 years ago

@dinohorvat Appreciate the help. I've tried multiple proxies with no success so I'll just post the host and sitekey since the site I'm testing on is meant as an hcaptcha demo.

host: democaptcha.com sitekey: 51829642-2cda-4b09-896c-594f89d700cc

The website I'm testing is http://democaptcha.com/demo-form-eng/hcaptcha.html

dinohorvat commented 3 years ago

@aw1875 If the host doesn't have Invisible Captcha enabled, this "solver" won't work. In that case, your only option is something like 2captcha...

awxlfy commented 3 years ago

@dinohorvat Interesting. Using this repo with the fix from @FatihAraz I'm able to receive a response token from a site like this. Then I would manually open the console in chrome and set document.querySelector('[name="h-captcha-response"]').value = RESPONSE_TOKEN and document.querySelector('[name="g-recaptcha-response"]').value= RESPONSE_TOKEN. I'd have no problems submitting that form and it would work correctly. The only time I'm having issues is when I try to automate it using puppeteer since I don't want to setup a local environment to run the fix every time. I setup a part of my website that does this request (instead of using localhost) and I am able to get back a token such as: F0_eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJwYXNza2V5IjoiTk9DWVZDWmxSeERiVHJBcnFjcVlYWkYvT3IzNWNpNGRhOHZMRUhhWjZDeEtFb3YyRWJUMmZYeGQwS1luOTBPcU5OMzgvU1NBbkJmN3llWlVlZGhuRmNBRGVpMHdMVWZ3alBIZDBBdVRQRkZUK3lucHdQRUdlakc1NEQ2bnliN0l3Q2hZRnpGeXpoQ1NNeDFjYVBMY2RBYk1tWXVOUkVXL1A3ZzhlWjVzdnkwdm5OUzdWcXNZUWZUc2FjQWhqWlVOYktoaCtXQUhHamNUdVMyV3RQcTB3NHJqWXdHQ0RpNFF1Y2V2azY2YkZOTU40MUxXKzdvdHZiVjJVZTRqRFZpM2ZYa3RtUmV4d2NXZXUwMXFJSnp5UHdYeWFZNVAyZjhhaTBIM2tUeTFEbmY2K2hoUHF0MUI0dHUxNlgwPU5vUGlPdzBPOFQ5cmsza3AiLCJzaXRla2V5IjoiNTY5Y2JiYWEtMTcwMi00OTJkLWI4YWUtMmY5NmM2MGU2Njc1IiwiZXhwIjoxNjE1ODI3NTAwLCJwZCI6MH0.lVt2WYDgdrMwnx14jDo6YRbKkIYUGOOMQeTqJvoWfC0

nayde-fr commented 3 years ago

Update:

There was a change which now requires a version to be sent to /getcaptcha

So just attach v=e0a51cf to form data (or what ever the current version is).

Also as a side note, motionData is completely irrelevant - you don't have to send it.

However I noticed that when I set

const motionCount = randomFromRange(1000, 10000);

to :

const motionCount = randomFromRange(8000, 10000);

in the getMouseMovements function I reach a resolution rate close to 100%.

awxlfy commented 3 years ago

@nayde-fr you were able to get your puppeteer method to work?

nayde-fr commented 3 years ago

@nayde-fr you were able to get your puppeteer method to work?

Yes, working perfectly. I was hitting some invalid-input-response at the beginning cause I misformatted the post data. But finally I solved this problem using qs.stringify.

Here is my trysolve function :

async function trysolve(page, config) {
    let timestamp = Date.now() + randomFromRange(30, 120);

    response = await instance({
        method: 'post',
        url: 'https://hcaptcha.com/getcaptcha',
        data: qs.stringify({
            sitekey,
            host,
            n: await page.evaluate(response => hsw(response.c.req), config),
            c: JSON.stringify(config.c),
            motionData: {
                st: timestamp,
                dct: timestamp,
                mm: getMouseMovements(timestamp)
            }
        }),
        headers: {
            'content-type': 'application/x-www-form-urlencoded'
        }
    })
    .then(response => {
        return response;
    })
    .catch(error => {
        return error.response;
    })

    return response;
}

Where :

page is my puppeteer instance.
config is the result of the checksiteconfig command.
instance is an instance of axios created with a custom User-Agent header.

awxlfy commented 3 years ago

@nayde-fr I think I figured it out like 30 seconds after you posted this! I took a different approach but it works and its fairly quick with the responses. Probably going to clean my code up a little bit so I can export the functions to another file for use but thanks for all the help from everyone!

DrewRidley commented 3 years ago

{ c: { type: 'hsw', req: 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzIjoyLCJ0IjoidyIsImQiOiJmNTU2MWJhOS04ZjFlLTQwY2EtOWI1Yi1hMGIzZjcxOWVmMzQiLCJsIjoiaHR0cHM6Ly9hc3NldHMuaGNhcHRjaGEuY29tL2MvYmUxZTE5ZTMiLCJlIjoxNjE1OTQ1NzkxfQ.K9ZBQ_hJZzXsU_cZ60kjPFJrOr6Ulbcj6MksByGxvLk' }, success: false, 'error-codes': [] }

When I run it I just get "success" false without any errors. I followed the exact steps you suggested. Any ideas?

awxlfy commented 3 years ago

@DrewDaPilot are you trying to do this with puppeteer? If you are I made my solution into a simple module on NPMjs. If you're not then you can follow @FatihAraz's fix above. The only thing I noticed with his fix is that you may still get the wrong responses and have to refresh the page sometimes. The way you can fix that is a simple while loop such as:

while (true) {
    try {
        const response = await solveCaptcha('https://captcha-protected-site.com');

        // You can log the response and then break the loop
        console.log(response);
        break;

        // OR you could just return the response which would break the loop
        return response;
    } catch (e) {
        // You can log the error here or just let the loop restart
        console.log(e);
    }
}

DrewRidley commented 3 years ago

@aw1875 Indeed. I tried writing it as a expressjs server using puppeteer, however, I encountered that problem that I mentioned. Most of the code I wrote took inspiration from your repository, however, for some reason the server rejects it without an error message. I only used the browser to wrap hsw and everything else was done with axios requests (with a custom user-agent). I am really lost in regards to the server 'error' that I am facing. If you have any thoughts on the matter I would appreciate it. Right now I have a browser based solution that uses machine learning to solve the challenges given, but it would reduce cost and solve time if I can immediately generate a pass. I would love to hear your input or suggestions.

awxlfy commented 3 years ago

@DrewDaPilot when you make your post request to /getcaptcha what does your n look like as well as your c?

For example my response looks like this:

  response = await request({
    method: "post",
    headers,
    json: true,
    url: "https://hcaptcha.com/getcaptcha",
    form: {
      sitekey,
      host,
      n: hswResponse[0],
      c: JSON.stringify(hswResponse[1]),
      motionData: {
        st: timestamp,
        dct: timestamp,
        mm: getMouseMovements(timestamp),
      },
    },
  });

My n value is coming from:

await page.evaluate((response) => hsw(response.c.req), response)

which is usually just a ton of numbers.

While my c value is coming from response["c"]. Then you need to make sure to use the JSON.stringify command on it within the post request (as you can see I did). Even though it is already a json response I noticed that it wasn't getting posted correctly until I explicitly made sure it was JSON.

I'd like to make sure you're getting proper responses at each step in your code so we can try and narrow down why you aren't getting the correct response in the end.

DrewRidley commented 3 years ago

If you would like and have a discord perhaps we can troubleshoot there? The only change I can think of between your code and mine would be the fact that you seem to execute everything from within the browser, whereas, I only execute hsw from the browser. I am happy to send over some example data but the hsw function executes without an error (invalid data would throw an error), my headers are all identical... I used charles proxy to get an ideas of the differences in requests between the real captcha response and the forged one and the only difference is of course the req and n value. I have a lurking suspicion that the n value being generated is based on a timestamp and the puppeteer overhead to evaluate a script on the page and return it involves enough latency so the hashed value n is considered old. From my research the hsw function hashes the req value with a timestamp to prevent time based attacks. It is also possible that the hsw function reads the browser URL/href to determine if the browser is currently on the same page the captcha is being solved in. Unlike your example, my page is actually empty and I load only hsw onto the browser, nothing else. if the black box function checks the url of the browser page then its likely that is how it is being detected.