Cloudflare Challenge

(function () {
  const obj = {
    render: function () {
      const { action, cData, chlPageData } = arguments[1];
        const params = [
          ["action", action],
          ["data", cData],
          ["pageData", chlPageData],
        ];
        console.table(params)
    }
  };

  Object.defineProperty(window, "turnstile", {
    get: () => {
      return obj;
    },
  });
})();

Standard Turnstile:

Stylized variants:

The challenge is seamlessly integrated into the website.

Looks like a normal Turnstile captcha, but it is actually a Cloudflare challenge.

To confirm Challenge presence, open developer tools, inspect network traffic, and check the page source:

• The first request to the site returns a 403 status code.
• The form with id challenge-form has an action attribute containing __cf_chl_f_tk=.
• The page contains two similar <script> tags that create new values in the window object.

import { chromium } from "playwright";

(async () => {
  const browser = await chromium.launch({ headless: false });
  const page = await browser.newPage();

  let params = null;

  try {
    while (!params) {
      await page.goto("https://example.com");

      await page.evaluate(() => {
        window.turnstile = new Proxy(window.turnstile, {
          get(target, prop) {
            if (prop === "render") {
              return function (a, b) {
                const p = {
                  websiteKey: b.sitekey,
                  websiteURL: window.location.href,
                  data: b.cData,
                  pagedata: b.chlPageData,
                  action: b.action,
                  userAgent: navigator.userAgent,
                };
                window.params = p;
                return target.render.apply(this, arguments);
              };
            }
            return target[prop];
          },
        });
      });

      params = await page.evaluate(() => {
        return new Promise((resolve) => {
          setTimeout(() => resolve(window.params || null), 5000);
        });
      });

      if (!params) {
        await page.waitForTimeout(3000);
      }
    }

    console.log("Turnstile Params:", params);
  } finally {
    await browser.close();
  }
})();

import { chromium } from "playwright";
import { Buffer } from "buffer";

(async () => {
  const browser = await chromium.launch({ headless: false });
  const page = await browser.newPage();

  let websiteKey = null;

  while (!websiteKey) {
    await page.goto("https://example.com");

    await page.evaluate(() => {
      window.turnstile = new Proxy(window.turnstile, {
        get(target, prop) {
          if (prop === "render") {
            return function (a, b) {
              window.websiteKey = b.sitekey;
              return target.render.apply(this, arguments);
            };
          }
          return target[prop];
        },
      });
    });

    websiteKey = await page.evaluate(() => {
      return new Promise((resolve) => {
        setTimeout(() => resolve(window.websiteKey || null), 5000);
      });
    });

    if (!websiteKey) {
      await page.waitForTimeout(3000);
    }
  }

  const html = await page.content();
  const htmlPageBase64 = Buffer.from(html).toString("base64");

  const result = {
    websiteKey,
    htmlPageBase64,
  };

  console.log(result);

  await browser.close();
})();