Skip to content

Instantly share code, notes, and snippets.

@moien007
Last active January 20, 2022 12:49
Show Gist options
  • Save moien007/06656aa4032c45b629a507dd4dcb6fd6 to your computer and use it in GitHub Desktop.
Save moien007/06656aa4032c45b629a507dd4dcb6fd6 to your computer and use it in GitHub Desktop.
[C#] Bypass testcookie-nginx-module bot protection
/*
Author: Moien007
Source: https://gist.github.com/moien007/06656aa4032c45b629a507dd4dcb6fd6
Description:
Bypass testcookie-nginx-module bot protection
Web host providers like Byethost uses that module so...
*/
using System;
using System.Linq;
using System.Threading.Tasks;
using System.Security.Cryptography;
using System.Net;
using System.Net.Http;
namespace Gist
{
class CustomWebClient
{
const string TestCookieSign = "aes.js";
public static byte[] Get(string url)
{
var address = new Uri(url);
var cookieContainer = new CookieContainer();
using (var handler = new HttpClientHandler() { CookieContainer = cookieContainer })
using (var client = new HttpClient(handler))
{
var content = client.GetAsync(address).WaitResult().Content;
var script = content.ReadAsStringAsync().WaitResult();
if (!script.Contains(TestCookieSign))
{
return content.ReadAsByteArrayAsync().WaitResult();
}
var test = Decrypt(script);
cookieContainer.Add(new Cookie("__test", test) { Domain = address.Host });
content = client.GetAsync(address).WaitResult().Content;
if (content.ReadAsStringAsync().WaitResult().Contains(TestCookieSign))
{
throw new Exception();
}
return content.ReadAsByteArrayAsync().WaitResult();
}
}
public static byte[] Post(string url, byte[] data)
{
var address = new Uri(url);
var cookieContainer = new CookieContainer();
using (var handler = new HttpClientHandler() { CookieContainer = cookieContainer })
using (var client = new HttpClient(handler))
using (var post = new ByteArrayContent(data))
{
var content = client.PostAsync(address, post).WaitResult().Content;
var script = content.ReadAsStringAsync().WaitResult();
if (!script.Contains(TestCookieSign))
{
return content.ReadAsByteArrayAsync().WaitResult();
}
var test = Decrypt(script);
cookieContainer.Add(new Cookie("__test", test) { Domain = address.Host });
content = client.PostAsync(address, post).WaitResult().Content;
if (content.ReadAsStringAsync().WaitResult().Contains(TestCookieSign))
{
throw new Exception();
}
return content.ReadAsByteArrayAsync().WaitResult();
}
}
static string Decrypt(string script)
{
var split = script.Split(new[] { "toNumbers(\"", "\")" }, StringSplitOptions.RemoveEmptyEntries)
.Where(s => s.Length == 32)
.ToArray();
if (split.Length != 3)
throw new Exception();
var key = StringToByteArray(split[0]);
var iv = StringToByteArray(split[1]);
var bytesIn = StringToByteArray(split[2]);
var aes = Aes.Create();
aes.Padding = PaddingMode.None;
aes.Mode = CipherMode.CBC;
aes.BlockSize = 128;
aes.KeySize = 128;
aes.Key = key;
aes.IV = iv;
var decrypter = aes.CreateDecryptor();
var decrypted = decrypter.TransformFinalBlock(bytesIn, 0, bytesIn.Length);
decrypter.Dispose();
aes.Dispose();
return BitConverter.ToString(decrypted).Replace("-", "").ToLower();
}
static byte[] StringToByteArray(string hex) // Taken from https://stackoverflow.com/a/321404/9248173
{
return Enumerable.Range(0, hex.Length)
.Where(x => x % 2 == 0)
.Select(x => Convert.ToByte(hex.Substring(x, 2), 16))
.ToArray();
}
}
static class ExtensionMethods
{
public static T WaitResult<T>(this Task<T> task)
{
task.Wait();
return task.Result;
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment