+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] CloudFlare "Bypass" [No WebBrowser] (/showthread.php?tid=4530083)
Pages: Pages
1
2
CloudFlare "Bypass" [No WebBrowser] - idb. - Nov 9, 2014
A site that I was working with recently implemented CF so it was fucking with my automation over WebRequests code. Threw this together so that I could go through CloudFlare without having to use a WebBrowser method (similar to the one provided here: https://hackforums.net/showthread.php?tid=3762105 ). Interesting little piece of code though. Shows how to emulate some Javascript, which from what I've seen most people haven't really messed with outside of the Browser.
Before I get into it let me make mention that you need to add a reference to the Microsoft Script Control in order for it to work properly. Also keep in mind that I've only tested this code on a few sites. There could be errors when parsing the JS values. If it's fucking up for you, drop a line and let me know so I can update.
Code
Imports System.Runtime.InteropServices
Imports System.Text
Imports System.Text.RegularExpressions
Friend Class CloudFlare
Public Shared Function Bypass(html As String, host As String) As DictionaryEntry
Dim js As New MSScriptControl.ScriptControl() With {.AllowUI = False, .Language = "JScript"}
Dim result As DictionaryEntry = Nothing
Try
Dim m As MatchCollection = Regex.Matches(html, "var t,r,a,f, (?<value>.*?|[\s\S]*?)a.value")
If m.Count.Equals(0) Then Throw New Exception("Could not parse script values.")
Dim value As String = m(0).Groups("value").Value
Dim key As String = String.Join(".", value.Split("="c)(0), value.Split(""""c)(1))
Dim lines As New List(Of String)
For Each line As String In From item In value.Split(";"c) Select item = item.Trim Where Not String.IsNullOrEmpty(item) Where item.StartsWith(key.Split("."c)(0))
If line.StartsWith(key.Split("."c)(0) & "=") Then
lines.Add("var " & line & ";")
Else
lines.Add(line & ";")
End If
Next
Dim code As New StringBuilder("function bypass(host)")
With code
.AppendLine("{")
For Each line As String In lines
.AppendLine(line)
Next
.AppendLine(String.Format(" var res = parseInt({0}, 10) + host.length;", key))
.AppendLine(" return res;")
.AppendLine("}")
js.AddCode(.ToString)
End With
Dim params As Object() = New Object() {host}
result = New DictionaryEntry(Regex.Match(html, """([a-fA-F\d]{32})""").Groups(1).Value, js.Run("bypass", params).ToString)
Catch ex As Exception
Finally
js.Reset()
Marshal.FinalReleaseComObject(js)
js = Nothing
End Try
Return result
End Function
End ClassIn order to use this you will need to pass the html that was returned from the CF page that appears when you're requesting whatever Url you're requesting.
Code
Dim cf As DictionaryEntry = CloudFlare.BypassCloudflare(html, "bombshare.altervista.org")
If cf.Key IsNot Nothing Then
Debug.Print("vc: " & cf.Key.ToString)
Debug.Print("answer: " & cf.Value.ToString)
End IfAlso make sure that you account for the __cfduid (returned when you request the page and CF is returned) & cf_clearance (returned when you perform your request to /cdn-cgi/l/chk_jschl in order to pass through the CF) cookies. Without these cookies you will just get the CF landing page over and over.
If I get some more free time today I'll try to throw together a little example to show how this is actually used. For now having the required values returned to you should be good enough.
Anyhow, hope this helps someone out there. If not, shrug atleast I was entertained for a brief period of time. lol.
* - Earn - Nov 9, 2014
This seems like a great script. I am not sure why others haven't taken interest. It is finally something that is unique in this section & no one comments.
Anyway, great work. I will test it out when I am on my computer.
* - #Kat - Nov 9, 2014
very nice look forward to using on a small project
* - SIM-478284 - Nov 9, 2014
Nice share! I'm not going to use the code, though, I'm just posting to keep the thread alive.
Btw, I've always liked things you've shared in this forum.
* - idb. - Nov 10, 2014
Thanks guys. The kind words are appreciated :)
* - Cornflower Blue இڿڰۣ-ڰۣ— - Nov 10, 2014
Glad to see you back to programming Idb, missed seeing ya around :)
OT: Pretty cool release, always trying to prevent the use of shitty web browsers I see.
* - idb. - Nov 10, 2014
(Nov 10, 2014 07:44 AM)Cornflower Blue இڿڰۣ-ڰۣ— Wrote: Glad to see you back to programming Idb, missed seeing ya around :)
OT: Pretty cool release, always trying to prevent the use of shitty web browsers I see.
I never stopped brother. I been busy with projects for customers. This was a part of a project that I didn't feel needed to be kept a secret, and thought it could benefit people so figured why not share? Figured it was something that's a bit different than the usual as well. I'm still gonna put together a little example for this, I just don't have time right now.
* - CodeAssassin - Nov 11, 2014
Very nice, great to see some javascript handling outside of the webbrowser :)
Thanks again for the share!
* - DisguiserNET - Nov 11, 2014
nice share, exspecially the patr of executing js
* - Cairns - Nov 11, 2014
Nice example buddy. I haven't personally used MSScriptControl I usually create a web browser instance and execute the script from there but no doubt MSScriptControl can perform better. Thanks for the share
* - idb. - Nov 11, 2014
(Nov 11, 2014 02:19 PM)Cairns Wrote: Nice example buddy. I haven't personally used MSScriptControl I usually create a web browser instance and execute the script from there but no doubt MSScriptControl can perform better. Thanks for the share
I just found out about it myself as well. Creating instances of WB drives the resources up way higher than they should go though which is why I wanted to find an alternative.
* - +Haze - Apr 30, 2016
Though this is a 2 year old thread, I still feel like it's still very valuable. I used this today on a C# project and it worked a fucking treat. Thanks idb, you saved me a lot of time.
* - idb. - Apr 30, 2016
Glad to hear it's still working and was able to be put to use. Enjoy! :)
* - R@bbit - May 2, 2016
Nice share dude! thanks for code :-)
* - HopperSat - May 2, 2016
Anyway, great work. I will test it out when I am on my computer.