eres69/cloudflare-bypass-api

1import requests2from curl_cffi import requests as curl_requests3import time4import os5 6# Read from environment, default to HF Spaces port7API_URL = os.getenv("API_URL", "http://127.0.0.1:7860/scrape")8API_KEY = os.getenv("API_KEY", "my_secret_key_123")9 10# A famously strict site to test the hybrid bypass11TARGET_SITE = "https://demo.turnstile.workers.dev/"12 13def call_heavy_browser_solver(url: str):14    """Triggers the invisible Chrome window to visually solve the Turnstile and steal cookies."""15    print(f"\n[!] Cloudflare JS Challenge activated.")16    print(f"[*] Waking up the Heavy Browser API to solve Turnstile for: {url}")17    18    headers = {"X-API-Key": API_KEY}19    # Send the payload expecting the API to route it appropriately (it handles headless config intrinsically via xvfb)20    response = requests.post(API_URL, headers=headers, json={21        "url": url,22    })23    24    response.raise_for_status()25    payload = response.json()26    27    print(f"[+] 🍪 Browsers extracted Cookie Payload: {len(payload.get('cookies', {}))} cookies")28    return payload29 30def run_hybrid_scraper(url: str):31    print("\n=== STARTING TIER 1 HYBRID NETWORK SCRAPER (3-STAGE) ===")32    print(f"[*] API URL: {API_URL}")33    34    # 1. Establish the "curl_cffi" network-spoofing session 35    # This flawlessly maths out the TLS and HTTP/2 packet structures of Chrome.36    session = curl_requests.Session(impersonate="chrome120")37    38    print(f"[*] Attempting Stage 1 Network Spoof bypass...")39    start_time = time.time()40    response = session.get(url)41    42    # We inspect the body. If it contains Cloudflare interstitial markers or 403 blocks...43    if "Just a moment..." in response.text or "cf-turnstile" in response.text or response.status_code in [403, 503]:44        print(f"[-] Stage 1 failed. The site forces JavaScript execution (HTTP {response.status_code}).")45        46        # 2. TRIGGER STAGE 2: THE SELENIUM BROWSER SOLVER47        solver_data = call_heavy_browser_solver(url)48        49        # 3. THE HANDOFF50        # We take the dynamic User-Agent and the clearance cookies from the heavy browser51        # and forcefully inject them into our lightweight 0-RAM network spoof session.52        print("\n[*] Handing off exact Browser Fingerprint to our lightweight spoof session...")53        session.headers.update({"User-Agent": solver_data["user_agent"]})54        55        for cookie_name, cookie_value in solver_data["cookies"].items():56            session.cookies.set(cookie_name, cookie_value)57            58        print("[*] Re-attempting instant HTML pull holding the golden CF Cookies...")59        fast_start = time.time()60        61        # 4. FINAL SCRAPE62        success_response = session.get(url)63        print(f"[+] Success! Downloaded website HTML flawlessly in {time.time() - fast_start:.3f} seconds!")64        print(f"[★] From now on, you can scrape ANY page on this site with this session instantly without triggering the browser API again!")65        66        return success_response.text67        68    else:69        print(f"[+] Incredible! Passed straight through on Stage A TLS impersonation! (Time: {time.time() - start_time:.3f}s)")70        return response.text71 72if __name__ == "__main__":73    html_output = run_hybrid_scraper(TARGET_SITE)74    print("\n--- Scraped Site Data Snippet ---")75    print(html_output[:500])76