RyuzakiH / CloudflareSolverRe

Cloudflare Javascript & reCaptcha challenge (I'm Under Attack Mode or IUAM) solving / bypass .NET Standard library.
MIT License
179 stars 49 forks source link

maybe cloudflare change there code again #28

Closed longcharmroeun closed 4 years ago

longcharmroeun commented 4 years ago

`var target = new Uri("https://kissasian.sh/");

                var cf = new CloudflareSolver
                {
                    MaxTries = 3,
                    ClearanceDelay = 3000
                };

                var handler = new HttpClientHandler();
                var client = new HttpClient(handler);

                var result1 = cf.Solve(client, handler, target).Result;

                if (!result1.Success)
                {
                    Console.WriteLine($"[Failed] Details: {result1.FailReason}");
                    return;
                }

                // Once the protection has been bypassed we can use that HttpClient to send the requests as usual
                var content = client.GetStringAsync(target).Result;
                Console.WriteLine($"Server response: {content}");
                break;`

Unhandled exception. System.AggregateException: One or more errors occurred. (Input string was not in a correct format.) ---> System.FormatException: Input string was not in a correct format. at System.Number.ThrowOverflowOrFormatException(ParsingStatus status, TypeCode type) at System.Double.Parse(String s) at CloudflareSolverRe.Types.Javascript.JsFuck.DecodeNumber(String encodedNumber) at CloudflareSolverRe.Types.Javascript.JsCalculation.Solve() at CloudflareSolverRe.Types.Javascript.JsCalculation.get_Result() at CloudflareSolverRe.Types.Javascript.JsChallenge.ApplyCalculation(Double number, IJsCalculation calculation) at System.Linq.Enumerable.Aggregate[TSource,TAccumulate](IEnumerable1 source, TAccumulate seed, Func3 func) at CloudflareSolverRe.Types.Javascript.JsChallenge.Solve() at CloudflareSolverRe.Solvers.JsChallengeSolver.SolveChallenge(String html) at CloudflareSolverRe.Solvers.JsChallengeSolver.Solve() at CloudflareSolverRe.CloudflareSolver.SolveJavascriptChallenge(Nullable1 jsDetectResult) at CloudflareSolverRe.CloudflareSolver.SolveWithJavascript(Int32 tries) at CloudflareSolverRe.CloudflareSolver.Solve() at CloudflareSolverRe.CloudflareSolver.Solve(HttpClient httpClient, CloudflareHandler cloudflareHandler, Uri siteUrl, CancellationToken cancellationToken) at CloudflareSolverRe.CloudflareSolver.<>c__DisplayClass30_0.<<Solve>b__0>d.MoveNext() --- End of stack trace from previous location where exception was thrown --- at CloudflareSolverRe.Utilities.SemaphoreLocker.LockAsync[T](Func1 worker) at CloudflareSolverRe.CloudflareSolver.Solve(HttpClient httpClient, HttpClientHandler httpClientHandler, Uri siteUrl, CancellationToken cancellationToken, Boolean randomUserAgent) --- End of inner exception stack trace --- at System.Threading.Tasks.Task.ThrowIfExceptional(Boolean includeTaskCanceledExceptions) at System.Threading.Tasks.Task1.GetResultCore(Boolean waitCompletionNotification) at System.Threading.Tasks.Task1.get_Result() at KissAsianData.Program.Main(String[] args) in C:\Users\Long charmroeun\source\repos\kisscambodia\KissAsianData\Program.cs:line 287 at KissAsianData.Program.

(String[] args)

C:\Users\Long charmroeun\source\repos\kisscambodia\KissAsianData>

longcharmroeun commented 4 years ago

they change

function(p){var p = eval(eval(e("ZG9jdW1l")+(undefined+"")[1]+(true+"")[0]+(+(+!+[]+[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+[!+[]+!+[]]+[+[]])+[])[+!+[]]+g(103)+(true+"")[3]+(true+"")[0]+"Element"+g(66)+(NaN+[Infinity])[10]+"Id("+g(107)+")."+e("aW5uZXJIVE1M"))); return +(p)}();

to

function(p){return eval((true+"")[0]+".ch"+(false+"")[1]+(true+"")[1]+Function("return escape")()(("")["italics"]())[2]+"o"+(undefined+"")[2]+(true+"")[3]+"A"+(true+"")[0]+"("+p+")")}(+((!+[]+(!![])+!![]+!![]+!![]+!![]+!![]+!![]+[])))));FsLhXWH.nhhfXxJAslmk-=+((!+[]+(!![])+!![]+!![]+!![]+!![]+!![]+!![]+[])+(!+[]+(!![])+!![])+(!+[]+(!![])+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]-(!![]))+(!+[]+(!![])+!![]+!![])+(+!![])+(!+[]+(!![])+!![]+!![]+!![]+!![])+(!+[]+(!![])+!![]+!![])+(!+[]+(!![])+!![]+!![]+!![]+!![]+!![]))/+((!+[]+(!![])+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(!+[]+(!![])+!![]+!![]+!![])+(!+[]+(!![])+!![]+!![])+(!+[]+(!![])+!![]+!![]+!![]+!![])+(!+[]-(!![]))+(!+[]+(!![])+!![]+!![])+(!+[]+(!![])+!![]+!![]+!![]+!![])+(!+[]+(!![])+!![]+!![]+!![]+!![]+!![])+(!+[]-(!![]))); and this !![] to (!![])

Akrelion45 commented 4 years ago

Would be awesome if you could push an Update like you did last week when you got it working :)

Artarex commented 4 years ago

Do you know what exactly needs to be changed in the code? I tried a few things, but unlike last week I couldn't bring it to work yet.

longcharmroeun commented 4 years ago

I know some change but my regular expression is not good xd

Artarex commented 4 years ago

Same for me. xD Everything that goes past basic regex is a no for me. Well, maybe someone else gets a solution in a few hours. Time to be patient :)

ngosang commented 4 years ago

Someone has the old HTML challenge to compare with the new one?

longcharmroeun commented 4 years ago

@ngosang

https://drive.google.com/open?id=1hjyZzGHgNz0sQxnzcZwMNIeyPy8P-9q5

iIIusi0n commented 4 years ago

anyone can share regex? :)

longcharmroeun commented 4 years ago

i change this (?:\+|\(|\)|\!|\[|\]|\/) to (?:\+|\-|\(|\)|\!|\[|\]|\/) to every code but it give me a wrong answer

longcharmroeun commented 4 years ago

i found the problem xd : !+[] == 1 !![] == 1 1+[]+2 == 12 so 1-[]+2==?

they add new operator

iIIusi0n commented 4 years ago

Cloudflare decide to block all of scraper and ddos attack :(

longcharmroeun commented 4 years ago

already fix new update Cloudflare but i use third party dependency so you can use it as temporary. https://www.nuget.org/packages/TemporaryWebclient/1.0.0

iIIusi0n commented 4 years ago

already fix new update Cloudflare but i use third party dependency so you can use it as temporary. https://www.nuget.org/packages/TemporaryWebclient/1.0.0

is it working now?

iIIusi0n commented 4 years ago

thank u sir! cool

whozerx commented 4 years ago

hey @longcharmroeun can u update solution on ur github too? Thanks.

longcharmroeun commented 4 years ago

hey @longcharmroeun can u update solution on ur github too? Thanks.

sure xd

ngosang commented 4 years ago

@longcharmroeun Thank you for the HTML. I was working in a different solution but using Jint too.

Take a look, I think this approach will survive most Cloudflare changes. Only the form fields are hardcoded and those are unlikely to change because that implies changes in his servers/backend.

Code and package => https://github.com/RyuzakiH/CloudflareSolverRe/pull/29

iIIusi0n commented 4 years ago

@longcharmroeun Thank you for the HTML. I was working in a different solution but using Jint too.

Take a look, I think this approach will survive most Cloudflare changes. Only the form fields are hardcoded and those are unlikely to change because that implies changes in his servers/backend.

Code and package => #29

could u update in your repos?

ngosang commented 4 years ago

Is in branch v1.0.7 I want to keep master aligned with this project by now.

https://github.com/ngosang/CloudflareSolverRe/tree/feature/v1.0.7

longcharmroeun commented 4 years ago

@ngosang you should try another ways without using third party dependency xd.

ngosang commented 4 years ago

I think using Jint is correct. It doesn't make much sense to maintain our own Javascript interpreter. It is a very small dependency (compiled it takes less than 100KB) and it is very popular. I have made this development for the Jackett project and I share it with the rest. If someone has a better solution I would like to hear it.

longcharmroeun commented 4 years ago

@ngosang My solution is simple you need to calculate +((!+[]+(!![])+!![]+!![]+!![]+!![]+!![]+!![]+[])+(+!![])+(!+[]+(!![])+!![]+!![]+!![]+!![]+!![])+(!+[]+(!![])+!![]+!![]+!![])+(!+[]-(!![]))+(!+[]+(!![])+!![]+!![])+(!+[]+(!![])-[])+(!+[]+(!![])+!![]+!![])+(!+[]+(!![])+!![])) in c#, in javascript the answer is 817504243.

Eric898989 commented 4 years ago

Another change (May 3rd) => challenge page returns with a 200 (OK) status code and not a 503 one... thus CloudflareSolverRe let it pass without trying anything. Moreover, in the tests, when I run it none of them provide a cloudflare challenge thus it make believe everything is working fine. Another test site would be useful which provide 100% of the time a challenge.

And by the way, @ngosang I agree with your approach about Jint

ngosang commented 4 years ago

@Eric898989 Could you share the url that is not working?

Eric898989 commented 4 years ago

It was https://wvv.zone-annuaire.com/, but today the page is again providing a 403 status code.

DexT3R5845 commented 4 years ago

It was https://wvv.zone-annuaire.com/, but today the page is again providing a 403 status code.

Captcha. I have the same problems with my service.

Eric898989 commented 4 years ago

I just noticed that the 200 status code is still given in case you have already a cf_clearance cookie, but for whatever reasons the website or cloudflare ask you again a hcaptcha! in this specific case the app is not detecting that a new clearance is required in spite of the cf_clearance cookie. Maybe we should also include in the CloudflareDetector.IsClearanceRequired this case, in checking if standard sentence"Please complete the security check to access" or "Attention Required! | Cloudflare" are present or not in the body response.

Eric898989 commented 4 years ago

The most weird is that even if you just managed to get a cf_clearance cookie thanks to the chrome privacypass extension for example, it will still ask you a hcaptcha on your next request! What is the point of a cf_clearance cookie...

longcharmroeun commented 4 years ago

@Eric898989 you can try this https://www.nuget.org/packages/TemporaryWebclient/1.0.0

It the same as the old one

iIIusi0n commented 4 years ago

i think we should find new solution to resolve uam. i tried to load uam page on WebBrowser control and export cookie. change user agent to chrome but it show me captcha after uam. in fiddler, user agent is working. anyone know how to solve this problem?

openbullet commented 4 years ago

@Eric898989 HCaptcha solving support is live on my fork by the way https://github.com/openbullet/CloudflareSolverRe

ngosang commented 4 years ago

@openbullet are you going to keep the fork updated?

openbullet commented 4 years ago

@ngosang In the foreseeable future yeah. My application entirely depends on it and I need it working so if you want to help out when CF changes its js you can submit a PR to my fork and I'll merge it. I already merged your last changes as they were good, so thank you for that.

longcharmroeun commented 4 years ago

@openbullet My project is depend on it too, it's great if you keep update it.

TK34213 commented 4 years ago

@openbullet thank you for fixing it! I ran sample in your fork and while ClearanceHandlerSample.Sample().Wait(); works, IntegrationSample.WebClientSample().Wait(); does not. It looks like cloudflare blocked re-using cookie and useragent from a successful solve?

ngosang commented 4 years ago

Update in #29 That change should bypass IUAM in most websites.