[FEATURE] 加强waf的5秒验证和人机认证

[jhqwqmc]

1Panel 版本

v1.10.11-lts

请描述您的需求或者改进建议

目前专业版的waf很容易被绕过，是否可以加强检测能力

请描述你建议的实现方案

No response

附加信息

绕过示例代码:

#此示例适用于5s和人机
import requests
from bs4 import BeautifulSoup

url = 'https://your.domain.name/'

s = requests.session()

r = s.get(url)
cookie = {
    'p_uv_id': r.cookies.get_dict()['p_uv_id']
}

soup = BeautifulSoup(r.text, 'lxml')
js = soup.find('script', type='text/javascript')
r_ = s.get(url + js['src'])
key = r_.text.split('const requestUrl = "')[1].split('";')[0]
r__ = s.get(key, cookies=cookie)
cookie.update(r__.cookies.get_dict())

r = s.get(url, cookies=cookie)
print(r.text)

#此示例适用于人机验证
from selenium import webdriver
from selenium.webdriver.common.by import By
from selenium.webdriver.edge.options import Options
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
from selenium.webdriver.common.action_chains import ActionChains
edge_options = Options()
edge_options.add_argument('--headless')
driver = webdriver.Edge(executable_path='./msedgedriver.exe', options=edge_options)
def findandwait(xpath, wait=1000000):
    try:
        return WebDriverWait(driver, wait).until(EC.element_to_be_clickable((By.XPATH, xpath)))
    except:
        return False
driver.get("https://your.domain.name/")
findandwait('//*[@id="dragHandler"]')
dragbutton = driver.find_element(by=By.XPATH, value='//*[@id="dragHandler"]')
ActionChains(driver).click_and_hold(dragbutton).move_by_offset(xoffset=260, yoffset=0).release().perform()

if findandwait('/html/body/header/nav/div/div[1]/a'): #这里随便填个进去可以查找到的元素的xpath即可
    print("绕过成功")

while True:pass

[wanghe-fit2cloud]

感谢您的反馈，我们先在本地调研一下可行性方案。