import logging import random import time import re # based off of https://gist.github.com/doko-desuka/58d9212461f62583f8df9bc6387fade2 # and https://github.com/Anorov/cloudflare-scrape # and https://github.com/VeNoMouS/cloudflare-scrape-js2py ''''''''' Disables InsecureRequestWarning: Unverified HTTPS request is being made warnings. ''''''''' import requests from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disable_warnings(InsecureRequestWarning) '''''' from requests.sessions import Session from copy import deepcopy try: from urlparse import urlparse except ImportError: from urllib.parse import urlparse DEFAULT_USER_AGENTS = [ "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36", "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36", "Mozilla/5.0 (Linux; Android 7.0; Moto G (5) Build/NPPS25.137-93-8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.137 Mobile Safari/537.36", "Mozilla/5.0 (iPhone; CPU iPhone OS 7_0_4 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11B554a Safari/9537.53", "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:59.0) Gecko/20100101 Firefox/59.0", "Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" ] DEFAULT_USER_AGENT = random.choice(DEFAULT_USER_AGENTS) BUG_REPORT = ( "Cloudflare may have changed their technique, or there may be a bug in the script.\n\nPlease read " "https://github.com/Anorov/cloudflare-scrape#updates, then file a " "bug report at https://github.com/Anorov/cloudflare-scrape/issues.") class CloudflareScraper(Session): def __init__(self, *args, **kwargs): super(CloudflareScraper, self).__init__(*args, **kwargs) if "requests" in self.headers["User-Agent"]: # Spoof Firefox on Linux if no custom User-Agent has been set self.headers["User-Agent"] = random.choice(DEFAULT_USER_AGENTS) def request(self, method, url, *args, **kwargs): resp = super(CloudflareScraper, self).request(method, url, *args, **kwargs) # Check if Cloudflare anti-bot is on if (resp.status_code in (503, 429) and resp.headers.get("Server", "").startswith("cloudflare") and b"jschl_vc" in resp.content and b"jschl_answer" in resp.content ): return self.solve_cf_challenge(resp, **kwargs) # Otherwise, no Cloudflare anti-bot detected return resp def solve_cf_challenge(self, resp, **original_kwargs): body = resp.text parsed_url = urlparse(resp.url) domain = parsed_url.netloc submit_url = "%s://%s/cdn-cgi/l/chk_jschl" % (parsed_url.scheme, domain) cloudflare_kwargs = deepcopy(original_kwargs) params = cloudflare_kwargs.setdefault("params", {}) headers = cloudflare_kwargs.setdefault("headers", {}) headers["Referer"] = resp.url try: cf_delay = float(re.search('submit.*?(\d+)', body, re.DOTALL).group(1)) / 1000.0 form_index = body.find('id="challenge-form"') if form_index == -1: raise Exception('CF form not found') sub_body = body[form_index:] s_match = re.search('name="s" value="(.+?)"', sub_body) if s_match: params["s"] = s_match.group(1) # On older variants this parameter is absent. params["jschl_vc"] = re.search(r'name="jschl_vc" value="(\w+)"', sub_body).group(1) params["pass"] = re.search(r'name="pass" value="(.+?)"', sub_body).group(1) if body.find('id="cf-dn-', form_index) != -1: extra_div_expression = re.search('id="cf-dn-.*?>(.+?)<', sub_body).group(1) # Initial value. js_answer = self.cf_parse_expression( re.search('setTimeout\(function\(.*?:(.*?)}', body, re.DOTALL).group(1) ) # Extract the arithmetic operations. builder = re.search("challenge-form'\);\s*;(.*);a.value", body, re.DOTALL).group(1) # Remove a function semicolon before splitting on semicolons, else it messes the order. lines = builder.replace(' return +(p)}();', '', 1).split(';') for line in lines: if len(line) and '=' in line: heading, expression = line.split('=', 1) if 'eval(eval(atob' in expression: # Uses the expression in an external
. expression_value = self.cf_parse_expression(extra_div_expression) elif '(function(p' in expression: # Expression + domain sampling function. expression_value = self.cf_parse_expression(expression, domain) else: expression_value = self.cf_parse_expression(expression) js_answer = self.cf_arithmetic_op(heading[-1], js_answer, expression_value) if '+ t.length' in body: js_answer += len(domain) # Only older variants add the domain length. params["jschl_answer"] = '%.10f' % js_answer except Exception as e: # Something is wrong with the page. # This may indicate Cloudflare has changed their anti-bot # technique. If you see this and are running the latest version, # please open a GitHub issue so I can update the code accordingly. logging.error("[!] %s Unable to parse Cloudflare anti-bots page. " "Try upgrading cloudflare-scrape, or submit a bug report " "if you are running the latest version. Please read " "https://github.com/Anorov/cloudflare-scrape#updates " "before submitting a bug report." % e) raise # Cloudflare requires a delay before solving the challenge. # Always wait the full delay + 1s because of 'time.sleep()' imprecision. time.sleep(cf_delay + 1.0) # Requests transforms any request into a GET after a redirect, # so the redirect has to be handled manually here to allow for # performing other types of requests even as the first request. method = resp.request.method cloudflare_kwargs["allow_redirects"] = False redirect = self.request(method, submit_url, **cloudflare_kwargs) if 'Location' in redirect.headers: redirect_location = urlparse(redirect.headers["Location"]) if not redirect_location.netloc: redirect_url = "%s://%s%s" % (parsed_url.scheme, domain, redirect_location.path) return self.request(method, redirect_url, **original_kwargs) return self.request(method, redirect.headers["Location"], **original_kwargs) else: return redirect def cf_sample_domain_function(self, func_expression, domain): parameter_start_index = func_expression.find('}(') + 2 # Send the expression with the "+" char and enclosing parenthesis included, as they are # stripped inside ".cf_parse_expression()'. sample_index = self.cf_parse_expression( func_expression[parameter_start_index: func_expression.rfind(')))')] ) return ord(domain[int(sample_index)]) def cf_arithmetic_op(self, op, a, b): if op == '+': return a + b elif op == '/': return a / float(b) elif op == '*': return a * float(b) elif op == '-': return a - b else: raise Exception('Unknown operation') def cf_parse_expression(self, expression, domain=None): def _get_jsfuck_number(section): digit_expressions = section.replace('!+[]', '1').replace('+!![]', '1').replace('+[]', '0').split('+') return int( # Form a number string, with each digit as the sum of the values inside each parenthesis block. ''.join( str(sum(int(digit_char) for digit_char in digit_expression[1:-1])) # Strip the parenthesis. for digit_expression in digit_expressions ) ) if '/' in expression: dividend, divisor = expression.split('/') dividend = dividend[2:-1] # Strip the leading '+' char and the enclosing parenthesis. if domain: # 2019-04-02: At this moment, this extra domain sampling function always appears on the # divisor side, at the end. divisor_a, divisor_b = divisor.split('))+(') divisor_a = _get_jsfuck_number(divisor_a[5:]) # Left-strip the sequence of "(+(+(". divisor_b = self.cf_sample_domain_function(divisor_b, domain) return _get_jsfuck_number(dividend) / float(divisor_a + divisor_b) else: divisor = divisor[2:-1] return _get_jsfuck_number(dividend) / float(_get_jsfuck_number(divisor)) else: return _get_jsfuck_number(expression[2:-1]) @classmethod def create_scraper(cls, sess=None, **kwargs): """ Convenience function for creating a ready-to-go requests.Session (subclass) object. """ scraper = cls() if sess: attrs = ["auth", "cert", "cookies", "headers", "hooks", "params", "proxies", "data"] for attr in attrs: val = getattr(sess, attr, None) if val: setattr(scraper, attr, val) return scraper ## Functions for integrating cloudflare-scrape with other applications and scripts @classmethod def get_tokens(cls, url, user_agent=None, **kwargs): scraper = cls.create_scraper() if user_agent: scraper.headers["User-Agent"] = user_agent try: resp = scraper.get(url, **kwargs) resp.raise_for_status() except Exception as e: logging.error("'%s' returned an error. Could not collect tokens." % url) raise domain = urlparse(resp.url).netloc cookie_domain = None for d in scraper.cookies.list_domains(): if d.startswith(".") and d in ("." + domain): cookie_domain = d break else: raise ValueError( "Unable to find Cloudflare cookies. Does the site actually have Cloudflare IUAM (\"I'm Under Attack Mode\") enabled?") return ({ "__cfduid": scraper.cookies.get("__cfduid", "", domain=cookie_domain), "cf_clearance": scraper.cookies.get("cf_clearance", "", domain=cookie_domain) }, scraper.headers["User-Agent"] ) def get_live_tokens(self, domain): for d in self.cookies.list_domains(): if d.startswith(".") and d in ("." + domain): cookie_domain = d break else: raise ValueError( "Unable to find Cloudflare cookies. Does the site actually have Cloudflare IUAM (\"I'm Under Attack Mode\") enabled?") return ({ "__cfduid": self.cookies.get("__cfduid", "", domain=cookie_domain), "cf_clearance": self.cookies.get("cf_clearance", "", domain=cookie_domain) }, self.headers["User-Agent"] ) @classmethod def get_cookie_string(cls, url, user_agent=None, **kwargs): """ Convenience function for building a Cookie HTTP header value. """ tokens, user_agent = cls.get_tokens(url, user_agent=user_agent, **kwargs) return "; ".join("=".join(pair) for pair in tokens.items()), user_agent create_scraper = CloudflareScraper.create_scraper get_tokens = CloudflareScraper.get_tokens get_cookie_string = CloudflareScraper.get_cookie_string