search

PortSwigger / bypass-bot-detection

Burp Suite extension that mutates ciphers to bypass TLS-fingerprint based bot detection
Apache License 2.0
197 stars 9 forks source link

cannot reproduce readme amazon example in burp 2024.8 #2

Closed NEX-S closed 1 month ago

NEX-S commented 1 month ago

cannot reproduce readme amazon example in burp 2024.8 after refresh, still need capcha code.

same happend in chatgpt.com cloudflare verify you are human (infinity loop)

NEX-S commented 1 month ago

need any logs?

d0ge commented 1 month ago

Hey @NEX-S I tested the extension with burpsuite_pro_v2024.8.jar and it works as expected. The example www.amazon.com behaviour was not changed. Please make sure that:

  1. Your IP address was not blocked, the simplest way to do that is to open www.amazon.com with any not proxied browser of latest version
  2. If the www.amazon.com doesn't show the CAPTCHA without Burp Suite, try manually change the Network setting at Settings -> Network -> TLS Negotiation -> Use custom protocols and ciphers, according to your browser TLS handshake
  3. If you would like to add the new browser to the extension please send the ja3 fingerprint in following format "4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10" and User-Agent string.

Please note, the extension is designed to bypass simple TLS fingerprint block lists, it cannot bypass aggressive bot detection.