does not work behind cloudflire

[drk1wi]

does not work behind cloudflire

[drk1wi]

I think it might be related to some JS verification code. Can you check the console log if there aren't any errors?

[ciberx]

log is: Listening on: [127.0.0.1:80] Proxying [loopback.modlishka.io:80] via --> [https://mysite.com] [Sat Jan 12 17:04:50 2019] DBG [RP] Checking domain: mysite.com [Sat Jan 12 17:04:50 2019] DBG [RP] Checking IP: X.X.X.X [Sat Jan 12 17:04:50 2019] DBG [RP] Checking IP: X.X.X.X [Sat Jan 12 17:04:50 2019] DBG [P] Proxying target [https://mysite.com] via phishing [loopback.modlishka.io] [Sat Jan 12 17:04:50 2019] DBG PatchHeaders: HTTPRequest took 8.6µs [Sat Jan 12 17:04:50 2019] DBG rewriteRequest took 2.393ms [Sat Jan 12 17:04:51 2019] DBG Rewriting Set-Cookie Flags: from [__cfduid=d0e4d63befcf8b48d89c6be8140cdc20f1547312691; expires=Sun, 12-Jan-20 17:04:51 GMT; path=/; domain=.mysite.com; HttpOnly; Secure] --> [__cfduid=d0e4d63befcf8b48d89c6be8140cdc20f1547312691; expires=Sun, 12-Jan-20 17:04:51 GMT; path=/; domain=.loopback.modlishka.io; HttpOnly; Secure] [Sat Jan 12 17:04:51 2019] DBG PatchHeaders: HTTPResponse took 4.3584ms [Sat Jan 12 17:04:51 2019] DBG Fallback to default compression () [Sat Jan 12 17:04:51 2019] DBG [rw] Rewriting Response Body for ( https://mysite.com): status[503] type[text/html; charset=UTF-8] encoding[] uncompressedBody[5094 bytes] [Sat Jan 12 17:04:51 2019] DBG rewriteResponse took 10.31ms

[ciberx]

I think it might be related to some JS verification code. Can you check the console log if there aren't any errors?

You right, in Cloudflare page JS script, witch generate verification code.

> <script type="text/javascript">
>   //<![CDATA[
>   (function(){
>     var a = function() {try{return !!window.addEventListener} catch(e) {return !1} },
>     b = function(b, c) {a() ? document.addEventListener("DOMContentLoaded", b, c) : document.attachEvent("onreadystatechange", b)};
>     b(function(){
>       var a = document.getElementById('cf-content');a.style.display = 'block';
>       setTimeout(function(){
>         var s,t,o,p,b,r,e,a,k,i,n,g,f, BrDDXtq={"PaRhNA":+((!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![])+(+[])+(!+[]+!![]+!![]+!![])+(!+[]+!![])+(!+[]+!![]+!![]+!![])+(!+[]+!![]+!![]))/+((!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(!+[]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![])+(+!![])+(!+[]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]))};
>         t = document.createElement('div');
>         t.innerHTML="<a href='/'>x</a>";
>         t = t.firstChild.href;r = t.match(/http?:\/\//)[0];
>         t = t.substr(r.length); t = t.substr(0,t.length-1);
>         a = document.getElementById('jschl-answer');
>         f = document.getElementById('challenge-form');
>         ;BrDDXtq.PaRhNA-=+((!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![])+(+[])+(!+[]+!![]+!![]+!![])+(!+[]+!![])+(!+[]+!![]+!![]+!![])+(!+[]+!![]+!![]))/+((+!![]+[])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![])+(!+[]+!![]+!![])+(!+[]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]));BrDDXtq.PaRhNA-=+((!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(!+[]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![])+(+[])+(!+[]+!![]+!![]))/+((!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(+!![])+(!+[]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![])+(!+[]+!![])+(!+[]+!![]+!![]+!![])+(+[]));BrDDXtq.PaRhNA*=+((!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(!+[]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(+[])+(!+[]+!![]+!![]+!![])+(+!![])+(!+[]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![])+(+!![]))/+((!+[]+!![]+[])+(+!![])+(!+[]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]));BrDDXtq.PaRhNA*=+((!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(!+[]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(+[])+(!+[]+!![]+!![]+!![])+(+!![])+(!+[]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]))/+((!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![])+(+[])+(!+[]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![])+(+[])+(!+[]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]));a.value = +BrDDXtq.PaRhNA.toFixed(10) + t.length; '; 121'
>         f.action += location.hash;
>         f.submit();
>       }, 4000);
>     }, false);
>   })();
>   //]]>
> </script>
> 

here domain is parsing

t = document.createElement('div');
t.innerHTML="<a href='/'>x</a>";
t = t.firstChild.href;r = t.match(/http?:\/\//)[0];
t = t.substr(r.length); t = t.substr(0,t.length-1);

other control the form
verification number generate this strings

 var s,t,o,p,b,r,e,a,k,i,n,g,f, BrDDXtq={"PaRhNA":+((!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![])+(+[])+(!+[]+!![]+!![]+!![])+(!+[]+!![])+(!+[]+!![]+!![]+!![])+(!+[]+!![]+!![]))/+((!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(!+[]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![])+(+!![])+(!+[]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]))};
BrDDXtq.PaRhNA-=+((!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![])+(+[])+(!+[]+!![]+!![]+!![])+(!+[]+!![])+(!+[]+!![]+!![]+!![])+(!+[]+!![]+!![]))/+((+!![]+[])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![])+(!+[]+!![]+!![])+(!+[]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]));BrDDXtq.PaRhNA-=+((!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(!+[]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![])+(+[])+(!+[]+!![]+!![]))/+((!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(+!![])+(!+[]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![])+(!+[]+!![])+(!+[]+!![]+!![]+!![])+(+[]));BrDDXtq.PaRhNA*=+((!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(!+[]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(+[])+(!+[]+!![]+!![]+!![])+(+!![])+(!+[]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![])+(+!![]))/+((!+[]+!![]+[])+(+!![])+(!+[]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]));BrDDXtq.PaRhNA*=+((!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(!+[]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(+[])+(!+[]+!![]+!![]+!![])+(+!![])+(!+[]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]))/+((!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![])+(+[])+(!+[]+!![]+!![]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![])+(+[])+(!+[]+!![]+!![]+!![])+(!+[]+!![]+!![]+!![]+!![]+!![]));a.value = +BrDDXtq.PaRhNA.toFixed(10) + t.length;

[drk1wi]

this looks like a nice JS obfuscation challenge. You will have to make sure that the challenge response form is submitted to the phishing domain . Did you get any error in the browsers console related to JS or with loading some network resources?

[ciberx]

error only with code 503

[drk1wi]

I would have to check it out on a live example. Never had to deal with cloudfire before, so I still didn't create any patch for their obfuscated JS.

[ignaloidas]

It's obfuscated using JSFuck,when de obfuscated it turns into

var s, t, o, p, b, r, e, a, k, i, n, g, f, BrDDXtq = { "PaRhNA": 0.9449327054957924 };
BrDDXtq.PaRhNA -= 4.6332352977948785;
BrDDXtq.PaRhNA -= 1.0561214128998724;
BrDDXtq.PaRhNA *= 3.8748301060430506
BrDDXtq.PaRhNA *= 0.8603531455472316
a.value = +BrDDXtq.PaRhNA.toFixed(10) + t.length;

so BrDDXtq.PaRhNA = -15.816591965380718

Don't have time now to deal with the rest though.

[szmarczak]

s, t, o, p, b, r, e, a, k, i, n, g,

Stop breaking! :D

[drk1wi]

This looks interesting, but in general it is related to JS client-side bypass, which is rather out of the scope (still it is definitely doable :-) ).

[drk1wi]

Actually, if you are able to bypass it please create a PR. We could have a seperate directory for different JS client-side bypasses.

[ciberx]

There is projects wich bypass cloudflare Antibot page
https://github.com/Anorov/cloudflare-scrape
https://github.com/KyranRana/cloudflare-bypass
https://github.com/codemanki/cloudscraper
i hope this helps

[drk1wi]

I am closing this issue since it's related to client side JS.