+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Web Development (https://hackforums.net/forumdisplay.php?fid=183)
+---- Thread: [PHP] working CF bypass (/showthread.php?tid=5295453)
Pages: Pages
1
2
working CF bypass - sizzuz - Jun 6, 2016
I was bored the other day, so it took a closer look at Cloudflares "I am under attack page". While doing so, i stumbled across an interesting header.
Code
Refresh: 8;URL=/cdn-cgi/l/chk_jschl?pass=1465214541.703-WYijW9RVYxFurther investigation showed, that it is not required to solve they javascript challenge at all. Wait the required time, then reload the page with the specified URL from the header and you will get clearance.
I wrote a short script for testing purposes and as proof of concept. As this is probably interesting for others too, i thought i share it:
http://pastebin.com/chgXentf
Unluckily i found this, after i was almost done solving the JavaScript with PHP and some funky regex 🤦♂
--- Update
Based on my previous findings i created attack scripts.
Usage: <target hostname> <proxy file/nofile> <threads> <time>
e.g.
php ./cfbypass.php http://www.mydomain.com proxies.txt 10 60
or if you dont want to use proxies
php ./cfbypass.php http://www.mydomain.com nofile 10 60
Version 1 bypasses using the Refresh header
http://pastebin.com/hW3Qdq5W
Version 2 bypasses by solving the JS challenge
http://pastebin.com/aafaNxur
* - Alex™ - Jun 6, 2016
This is very cool, gonna test it out in a bit and report back.
* - Conceal - Jun 6, 2016
Looks pretty good, will test it out later. You should have a large array of user agents as one can get blocked, also for proxies you should load them from a text file, pass them through as an array and foreach proxy resend a cURL request and as-well have forking.
I suppose if you're not leaning towards this being an attack script, but good job bud.
* - HFTetramorph - Jun 6, 2016
Don't worry, if this is anything legit it will be fixed by CloudFlare before the end of the week.
Otherwise, will test it out here in a bit.
* - Sakuto - Jun 6, 2016
This is really interesting, thanks for your share. Maybe you should post this in a hacking section too, just to get opinion from more qualified users?
* - CodeBinary - Jun 6, 2016
Is there a way to use this to get an ip?
* - Sakuto - Jun 6, 2016
(Jun 6, 2016 03:17 PM)Dashy Wrote: Is there a way to use this to get an ip?
This have nothing to do with unfortunately.
* - sizzuz - Jun 7, 2016
Thanks for the feedback.
I build a version as attack script. Grab it here:
http://pastebin.com/hW3Qdq5W
Usage: <target hostname> <proxy file/nofile> <threads> <time>
e.g.
php ./cfbypass.php http://www.mydomain.com proxies.txt 10 60
or if you dont want to use proxies
php ./cfbypass.php http://www.mydomain.com nofile 10 60
I would post this in the SST section, but i am not uB3r. Only ub3r are allowed to create new threads there.
* - Jerry Smith - Jun 7, 2016
Honestly OP this is a very generous thing of you to share, as most HF members would've kept this to themselves, or sold it to make profit from it.
* - Sakuto - Jun 7, 2016
Nice share you did there sizuss, the script is a great addition to the current thread and resources. I can post it in the SST section if you want, just PM me.
* - Alex™ - Jun 7, 2016
(Jun 7, 2016 03:52 AM)Sakuto Wrote: Nice share you did there sizuss, the script is a great addition to the current thread and resources. I can post it in the SST section if you want, just PM me.
Please fucking don't? This has so many legit uses, it will just get fixed if it gets used for ddos (I can already see OP wrote a script).
* - Decafe - Jun 7, 2016
(Jun 7, 2016 04:59 PM)Alex™ Wrote: Please fucking don't? This has so many legit uses, it will just get fixed if it gets used for ddos (I can already see OP wrote a script).
No, it won't. I released a ddos poc using a different method found here nearly 9 months ago and cloudflare does not give a single fuck.
* - HFTetramorph - Jun 7, 2016
Ah yes, I forgot I was going to test this.
After some standard testing of both the scripts, and manually playing with headers the method is correct. However this seems like it may be just a simple logic error on CloudFlare's side. Likely to be easily patched. If anyone is going to implement this I suggest instead implementing Decafe's listed method.
* - Insane Developer - Jun 7, 2016
This won't work. the pass value is obtained after calculating some maths with JS.
* - HFTetramorph - Jun 7, 2016
(Jun 7, 2016 09:39 PM)Insane Developer Wrote: This won't work. the pass value is obtained after calculating some maths with JS.
Did you even try it for yourself? The pass value is sent before. Then is used to calculate an answer. Returned to a special URL, which then validates a session cookie. The only problem is currently the logic doesn't require the answer and just visiting the special URL is enough to retrieve a session cookie.