captchaforge 0.2.39

Captcha detection and solving for Firefox and BiDi-driven browsers. Detection, vendor solver scaffolding, trusted cross-origin click delivery into nested OOPIFs, and stealth personas are implemented and tested; broad live-vendor solve rates are not yet benchmarked.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109

//! HTTP block-page markers shared with erroracle.
//!
//! Captcha **type** detectors (`turnstile`, `recaptcha`, `hcaptcha`, …) stay in
//! this crate. Generic block disposition and vendor **tokens** in response text
//! delegate to [`erroracle`](../../../../libs/scanner/erroracle). **Named WAF
//! product** identification is owned by [`wafrift_detect`](../../wafrift/crates/detect).

use erroracle::{
    body_has_waf_block_phrases, body_has_waf_markers, classify_response, HttpResponse,
    ResponseDisposition,
};

/// Interstitial phrases on captcha verify paths not covered by erroracle alone.
pub const CAPTCHAFORGE_BLOCK_EXTRAS: &[&str] = &[
    "sorry, you have been blocked",
    "pardon our interruption",
    "your request has been blocked",
    "this request has been blocked",
    "the owner of this website",
    "request unsuccessful",
    "you don't have permission",
    "automated access",
    "bot detected",
    "suspicious activity",
    "you have been rate limited",
    "rate limit exceeded",
    "permission denied",
    "security policy",
    "forbidden",
];

/// Whether an HTTP response looks blocked (token-replay / verify endpoints).
#[must_use]
pub fn http_response_indicates_block(status: u16, body: Option<&str>) -> bool {
    if !(200..300).contains(&status) {
        return true;
    }
    let Some(body) = body else {
        return false;
    };
    let lower = body.to_lowercase();
    if extras_indicate_block(&lower) {
        return true;
    }
    if body_has_waf_block_phrases(&lower) {
        return true;
    }
    // Vendor tokens need a blocking status in erroracle; use 403 surrogate for body-only scan.
    if body_has_waf_markers(&lower) {
        return matches!(
            classify_response(&HttpResponse::new(403, body)).disposition,
            ResponseDisposition::WafBlock | ResponseDisposition::RateLimited
        );
    }
    false
}

/// Whether live page title/body text indicates a hard block after a solve attempt.
#[must_use]
pub fn page_text_indicates_hard_block(title: &str, body_excerpt: &str) -> bool {
    let lower = format!("{}\n{}", title.to_lowercase(), body_excerpt.to_lowercase());
    extras_indicate_block(&lower) || body_has_waf_block_phrases(&lower)
}

fn extras_indicate_block(lower: &str) -> bool {
    CAPTCHAFORGE_BLOCK_EXTRAS.iter().any(|p| lower.contains(p))
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn http_block_delegates_to_erroracle_phrases() {
        assert!(http_response_indicates_block(
            200,
            Some("Sorry, REQUEST BLOCKED by policy")
        ));
    }

    #[test]
    fn http_block_uses_extras() {
        assert!(http_response_indicates_block(
            200,
            Some("Pardon Our Interruption while we verify")
        ));
    }

    #[test]
    fn http_block_clean_200_accepted() {
        assert!(!http_response_indicates_block(200, Some("{\"ok\": true}")));
    }

    #[test]
    fn page_text_uses_shared_phrases() {
        assert!(page_text_indicates_hard_block(
            "Access Denied",
            "your request was rejected"
        ));
    }

    #[test]
    fn benign_cloudflare_mention_not_hard_block_without_phrase() {
        assert!(!page_text_indicates_hard_block(
            "How Cloudflare works",
            "Cloudflare is a CDN"
        ));
    }
}