[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-96053":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":9,"language":10,"languages":9,"totalLinesOfCode":9,"stars":11,"forks":12,"watchers":13,"openIssues":14,"contributorsCount":14,"subscribersCount":14,"size":14,"stars1d":14,"stars7d":14,"stars30d":15,"stars90d":14,"forks30d":14,"starsTrendScore":14,"compositeScore":16,"rankGlobal":9,"rankLanguage":9,"license":17,"archived":18,"fork":18,"defaultBranch":19,"hasWiki":20,"hasPages":18,"topics":21,"createdAt":9,"pushedAt":9,"updatedAt":22,"readmeContent":23,"aiSummary":24,"trendingCount":14,"starSnapshotCount":14,"syncStatus":25,"lastSyncTime":26,"discoverSource":27},96053,"turnstile-bypass","Sophomoresty\u002Fturnstile-bypass","Sophomoresty","Cross-platform Cloudflare Turnstile solver (macOS, Windows, Linux)",null,"Python",440,159,212,0,152,56.61,"MIT License",false,"main",true,[],"2026-09-20 04:01:32","# turnstile-bypass\n\nSelf-contained Cloudflare challenge helper for macOS, Windows, and Linux.\n\nIt drives headed Chrome to pass the two CF layers people usually call “the shield”:\n\n1. **Turnstile widget** on a site page (e.g. `aipaycards.com\u002Flogin`) → JSON `token`\n2. **Interstitial waiting room** (`请稍候…` \u002F Just a moment, e.g. **grok.com**) → `cf_clearance` and the real origin\n\n`curl https:\u002F\u002Fgrok.com\u002F` is **403** + `cf-mitigated: challenge`. After `solve.py --url https:\u002F\u002Fgrok.com\u002F --fresh`, the same Chrome tab is the Grok app with a `cf_clearance` cookie.\n\nIt does **not** pass IP bans (1020), rate limits (1015), or Bot Fight when this Chrome is already rejected.\n\nA new agent should follow **Install** then **Use**. Nothing else is required.\n\n## Install\n\nNeeds: Python 3.10+, Google Chrome or Chromium.\n\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002FSophomoresty\u002Fturnstile-bypass.git\ncd turnstile-bypass\npython3 scripts\u002Finstall.py\n```\n\n`install.py` creates `.venv` in this repo, installs `requirements.txt` (DrissionPage), packs `assets\u002FturnstilePatch.zip`, and runs `scripts\u002Fpreflight.py`.\n\nYou want:\n\n```json\n{ \"ok\": true, \"methods\": { \"drissionpage\": true } }\n```\n\n| OS | If Chrome is not found |\n|---|---|\n| macOS | Install Google Chrome, or `export CHROME_PATH=\"\u002FApplications\u002FGoogle Chrome.app\u002FContents\u002FMacOS\u002FGoogle Chrome\"` |\n| Windows | `set CHROME_PATH=C:\\Path\\to\\chrome.exe` |\n| Linux | `sudo apt-get install -y google-chrome-stable` or `chromium` |\n| Linux, no desktop | `sudo apt-get install -y xvfb` then prefix commands with `xvfb-run -a` |\n\nManual install (same result):\n\n```bash\npython3 -m venv .venv\n.venv\u002Fbin\u002Fpython -m pip install -r requirements.txt   # Windows: .venv\\Scripts\\python.exe\npython3 scripts\u002Fpack_extension.py\npython3 scripts\u002Fpreflight.py\n```\n\n## Use\n\n```bash\npython3 scripts\u002Fsolve.py --url \"https:\u002F\u002Faipaycards.com\u002Flogin\"\npython3 scripts\u002Fsolve.py --url \"https:\u002F\u002Fgrok.com\u002F\" --fresh\n```\n\nStdout is one JSON object.\n\n- Widget success: `\"ok\": true` and `token` longer than 20 characters. Use it immediately (~300s TTL).\n- Waiting-room success (grok.com): `\"ok\": true` and `kind` is `cf_clearance` or `cf_passed`, with `clearanceLen` > 20. The tab is the real site.\n- Failure: `\"ok\": false` and `error`. Do not invent a token.\n\nForce a lane:\n\n```bash\npython3 scripts\u002Fsolve.py --lane drission --url \"https:\u002F\u002Fexample.com\u002Flogin\"\npython3 scripts\u002Fsolve.py --lane ab --url \"https:\u002F\u002Fexample.com\u002Flogin\"\n```\n\nLinux without GUI:\n\n```bash\nxvfb-run -a python3 scripts\u002Fsolve.py --url \"https:\u002F\u002Fexample.com\u002Flogin\"\n```\n\nDefault lane: **DrissionPage + packaged extension** after `install.py`. If `agent-browser-cli` and Node are already on `PATH`, `solve.py` prefers that faster lane (`TURNSTILE_PREFER_AB=0` to force Drission).\n\n`--lane ab` is optional and faster only if `agent-browser-cli` + Node are already installed **and** that Chrome already has this extension. Iframe clicks must use Chrome CDP (default port **19221**), never the shim **19222**.\n\nYesCaptcha (last resort): `YESCAPTCHA_CLIENT_KEY` and\n\n```bash\npython3 scripts\u002Fsolve.py --lane yescaptcha --url \"https:\u002F\u002Fexample.com\" --sitekey \"0x...\"\n```\n\n## Chrome extension\n\nSource of truth: **`assets\u002FturnstilePatch\u002F`** (load unpacked).\n\nPacked copy: **`assets\u002FturnstilePatch.zip`** (same two files). Rebuild with `python3 scripts\u002Fpack_extension.py`.\n\nThe extension is Manifest V3, `world: MAIN`, `all_frames`, matches `https:\u002F\u002Fchallenges.cloudflare.com\u002F*` only. It patches `MouseEvent.screenX\u002FY` because Chrome CDP clicks set screen coords equal to client coords ([chromium 40280325](https:\u002F\u002Fissues.chromium.org\u002Fissues\u002F40280325)), which Turnstile treats as a bot.\n\n**Load unpacked (manual Chrome):** `chrome:\u002F\u002Fextensions` → Developer mode → Load unpacked → select `assets\u002FturnstilePatch\u002F`.\n\nDrissionPage does this for you via `add_extension`. You do not need to click that UI for the default `solve.py` path.\n\n## What it is not\n\n| In scope | Out of scope |\n|---|---|\n| Turnstile widget on the origin page | Cloudflare **1020** \u002F **1015** \u002F WAF block |\n| Interstitial “请稍候…” \u002F Just a moment (JS or managed challenge) | Bot Fight when this Chrome is already banned |\n| `cf_clearance` + origin HTML | hCaptcha, reCAPTCHA, headless Chrome |\n\n## Verified\n\nmacOS, Chrome 152, agent-browser, CDP **19221**.\n\n| Target | What | Result | Time |\n|---|---|---|---|\n| https:\u002F\u002Fdemo.turnstile.workers.dev\u002F | dummy Turnstile | tokenLen 21 | 3.46s |\n| `examples\u002Finteractive-dummy.html` | dummy interactive | tokenLen 21 | 7.46s |\n| https:\u002F\u002Faipaycards.com\u002Flogin | production Turnstile | tokenLen **816**, 3\u002F3 | 8–11s |\n| https:\u002F\u002Fgrok.com\u002F | interstitial (`cf-mitigated: challenge`) | `kind=cf_clearance`, clearanceLen **533–597**, origin title Grok | ~9s (`--fresh`) |\n\n`curl` to grok.com without this Chrome is **403** + `cf-mitigated: challenge`. After solve, the same tab is the Grok app. Interstitial path focuses the tab (`Page.bringToFront`) and clicks the CF iframe; waiting-room JS often refuses to finish if `document.visibilityState` is `hidden`.\n\n```bash\npython3 scripts\u002Fsolve.py --url \"https:\u002F\u002Fgrok.com\u002F\" --fresh\npython3 scripts\u002Fe2e.py\n```\n\n## Layout\n\n```\nAGENTS.md                 # short runbook for coding agents\nREADME.md                 # this file\nLICENSE\nrequirements.txt          # DrissionPage\nassets\u002FturnstilePatch\u002F    # unpacked MV3 extension\nassets\u002FturnstilePatch.zip # same, zipped\nexamples\u002Finteractive-dummy.html\nscripts\u002Finstall.py            # venv + deps + pack + preflight\nscripts\u002Fe2e.py                # live two-page check; exit 0 only on success\nscripts\u002Fpreflight.py\nscripts\u002Fsolve.py          # entry\nscripts\u002Fsolve_turnstile.py\nscripts\u002Fpack_extension.py\nscripts\u002Fsolve_agent_browser.py\nscripts\u002Fcamoufox_turnstile.py\nscripts\u002Fsolve_yescaptcha.py\nscripts\u002Fproxy_auth_extension.py\nscripts\u002Fruntime.py\n```\n\n## Limits\n\n- Headed Chrome only. Interstitial needs the tab visible (`Page.bringToFront`).\n- Datacenter IPs often fail; one residential-proxy retry, then stop.\n- Do not cache tokens across sessions.\n- Not 1020\u002F1015\u002FWAF block, not a fingerprint browser.\n\n本项目的开发 agent 能力由 [GenericAgent](https:\u002F\u002Fgithub.com\u002Flsdefine\u002FGenericAgent) 提供。\n\n### 🚩 友情链接\n\n[![GenericAgent](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FAgent_Framework-GenericAgent-orange?style=for-the-badge&logo=github)](https:\u002F\u002Fgithub.com\u002Flsdefine\u002FGenericAgent)\n[![LinuxDo](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002F社区-LinuxDo-blue?style=for-the-badge)](https:\u002F\u002Flinux.do\u002F)\n\n## License\n\nMIT. See `LICENSE`.\n","这是一个跨平台的 Cloudflare Turnstile 挑战自动求解工具，用于绕过网页端的 Turnstile 人机验证（如登录页 widget）和 Cloudflare 等待室（如 grok.com 的‘请稍候…’页面），获取有效的 token 或 cf_clearance Cookie。项目基于 Python，集成 DrissionPage 浏览器自动化框架与定制化浏览器扩展，支持 macOS、Windows 和 Linux（含无头 Xvfb 环境），无需外部打码服务即可本地完成挑战交互。适用于自动化测试、爬虫调试、合规性研究等需临时绕过前端验证的开发与安全场景，不适用于规避 IP 封禁或对抗高级 Bot 检测。",2,"2026-09-09 02:30:05","CREATED_QUERY"]