[sizzuz]

I was bored the other day, so it took a closer look at Cloudflares "I am under attack page". While doing so, i stumbled across an interesting header.

Code

Refresh: 8;URL=/cdn-cgi/l/chk_jschl?pass=1465214541.703-WYijW9RVYx

Further investigation showed, that it is not required to solve they javascript challenge at all. Wait the required time, then reload the page with the specified URL from the header and you will get clearance.

I wrote a short script for testing purposes and as proof of concept. As this is probably interesting for others too, i thought i share it:
http://pastebin.com/chgXentf

Unluckily i found this, after i was almost done solving the JavaScript with PHP and some funky regex 🤦‍♂

--- Update

Based on my previous findings i created attack scripts.
Usage: <target hostname> <proxy file/nofile> <threads> <time>
e.g.
php ./cfbypass.php http://www.mydomain.com proxies.txt 10 60
or if you dont want to use proxies
php ./cfbypass.php http://www.mydomain.com nofile 10 60

Version 1 bypasses using the Refresh header
http://pastebin.com/hW3Qdq5W

Version 2 bypasses by solving the JS challenge
http://pastebin.com/aafaNxur

[Alex™]

This is very cool, gonna test it out in a bit and report back.

[Conceal]

Looks pretty good, will test it out later. You should have a large array of user agents as one can get blocked, also for proxies you should load them from a text file, pass them through as an array and foreach proxy resend a cURL request and as-well have forking.

I suppose if you're not leaning towards this being an attack script, but good job bud.

[HFTetramorph]

Don't worry, if this is anything legit it will be fixed by CloudFlare before the end of the week.

Otherwise, will test it out here in a bit.

[Sakuto]

This is really interesting, thanks for your share. Maybe you should post this in a hacking section too, just to get opinion from more qualified users?

[CodeBinary]

Is there a way to use this to get an ip?

[Sakuto]

Is there a way to use this to get an ip?

This have nothing to do with unfortunately.

[sizzuz]

Thanks for the feedback.
I build a version as attack script. Grab it here:
http://pastebin.com/hW3Qdq5W

Usage: <target hostname> <proxy file/nofile> <threads> <time>
e.g.
php ./cfbypass.php http://www.mydomain.com proxies.txt 10 60
or if you dont want to use proxies
php ./cfbypass.php http://www.mydomain.com nofile 10 60

I would post this in the SST section, but i am not uB3r. Only ub3r are allowed to create new threads there.

[Jerry Smith]

Honestly OP this is a very generous thing of you to share, as most HF members would've kept this to themselves, or sold it to make profit from it.

[Sakuto]

Nice share you did there sizuss, the script is a great addition to the current thread and resources. I can post it in the SST section if you want, just PM me.

[Alex™]

Nice share you did there sizuss, the script is a great addition to the current thread and resources. I can post it in the SST section if you want, just PM me.

Please fucking don't? This has so many legit uses, it will just get fixed if it gets used for ddos (I can already see OP wrote a script).

[Decafe]

Please fucking don't? This has so many legit uses, it will just get fixed if it gets used for ddos (I can already see OP wrote a script).

No, it won't. I released a ddos poc using a different method found here nearly 9 months ago and cloudflare does not give a single fuck.

[HFTetramorph]

Ah yes, I forgot I was going to test this.
After some standard testing of both the scripts, and manually playing with headers the method is correct. However this seems like it may be just a simple logic error on CloudFlare's side. Likely to be easily patched. If anyone is going to implement this I suggest instead implementing Decafe's listed method.

[Insane Developer]

This won't work. the pass value is obtained after calculating some maths with JS.

[HFTetramorph]

This won't work. the pass value is obtained after calculating some maths with JS.

Did you even try it for yourself? The pass value is sent before. Then is used to calculate an answer. Returned to a special URL, which then validates a session cookie. The only problem is currently the logic doesn't require the answer and just visiting the special URL is enough to retrieve a session cookie.