search

sayem314 / hooman

http interceptor to hoomanize cloudflare requests
https://www.npmjs.com/package/hooman
MIT License
148 stars 18 forks source link

Hooman can't bypass new challenge #26

Open Cosmysd opened 4 years ago

Cosmysd commented 4 years ago

Describe the bug

Actual behavior

It seems that the hooman is outdated, it can't get around the new cloudflare challenge, I tested it on several websites, none of it can be outdated, except sometimes, when the protection is not active

Okay, so the new cloudflare challenge only appears when it detects malicious requests, or multiple attempts from the same IP address, or the server is already attacked, etc. The new challenge checks the 'browser' to see if you are real or bot, after which you will have to get the token for uam, (the cookie) and after you have obtained the cloudflare cookie displays a free captcha that must be completed.

Hooman can't detect both at once, I've already tried this on a few urls, below is a list

https://cyberwarblog.xyz - bypassed failed https://fatality.win/ - bypassed failed https://botflare.xyz/ - bypassed failed

Beware, cloudflare doesn't always display the captcha request, so sometimes bypass works, but 90% don't

One option would be to use extra puppeteer to get around the new challenge A exemple u can see here https://github.com/JimmyLaurent/cloudflare-scraper

Expected behavior

write here

Code to reproduce

const hooman = require('hooman');

(async () => {
  try {
    const response = await hooman.get('https://sayem.eu.org');
    console.log(response.body);
    //=> '<!doctype html> ...'
  } catch (error) {
    console.log(error.response.body);
    //=> 'Internal server error ...'
  }
})();

but also tried with captcha

Checklist