Detektor CAPTCHA di C#: Temukan Jenisnya, Panggil CapSkip

dotnet new console -o detect-demo
cd detect-demo
dotnet add package CapSkip

using System.Net;
using System.Text.Json;
using System.Text.RegularExpressions;
using CapSkip;

public record Info(string Type, string? Method, Dictionary<string, object?> Args,
    string? NeedsBrowser = null, bool Unsupported = false, string[]? Also = null);
record Page(string H, string Srcs, string Js, string Url);

public static class Detector
{
    const RegexOptions F = RegexOptions.IgnoreCase | RegexOptions.Singleline | RegexOptions.CultureInvariant;
    const string SiteKeyJs = """sitekey['"]?\s*:\s*['"]([^'"]+)""";

    static string? Grab(string pattern, string? text)  // first capture group that matched, or null
    {
        var m = Regex.Match(text ?? "", pattern, F);
        for (var i = 1; i < m.Groups.Count; i++) if (m.Groups[i].Success) return m.Groups[i].Value;
        return null;
    }
    static string? Or(params string?[] v) => v.FirstOrDefault(s => !string.IsNullOrEmpty(s));
    static string Abs(string url, string rel) => Uri.TryCreate(new Uri(url), rel, out var u) ? u.AbsoluteUri : rel;
    static Dictionary<string, object?> Args(params (string, object?)[] kv) =>  // null values are left out
        kv.Where(x => x.Item2 != null).ToDictionary(x => x.Item1, x => x.Item2);

    static string? Attr(string? tag, string name) =>  // attribute value, either quote style, HTML-decoded
        Grab("""\s""" + name + """\s*=\s*(?:"([^"]*)"|'([^']*)')""", tag) is { } v ? WebUtility.HtmlDecode(v) : null;
    static string? Tag(string cls, string h) =>  // opening tag that has CSS class cls
        Grab("""(<\w+[^>]*\sclass\s*=\s*["'][^"']*(?<![\w-])""" + cls + """(?![\w-])[^"']*["'][^>]*>)""", h);
    static string? Opts(string call, string js) => Grab(call + """\([^,]+,\s*\{(.{0,400})""", js);

    static Page Parse(string html, string url)
    {
        var h = Regex.Replace(html, """<!--.*?-->|<style\b.*?</style>""", "", F);
        var srcs = Regex.Matches(h, """<script\b[^>]*?\ssrc\s*=\s*["']([^"']+)""", RegexOptions.IgnoreCase);
        var js = Regex.Matches(h, """<script\b[^>]*>(.*?)</script>""", F);
        return new(h, WebUtility.HtmlDecode(string.Join(" ", srcs.Select(m => m.Groups[1].Value))),
                   string.Join("\n", js.Select(m => m.Groups[1].Value)), url);
    }
    static Info Browser(string type, string method, Page p, string why) =>  // HTML is not enough: do not guess
        new(type, method, new() { ["url"] = p.Url }, why);
    static readonly (string, string)[] Vendors = { ("arkose", """arkoselabs\.com/v2/|funcaptcha\.com/fc/"""),
        ("geetest_v4", """gt4\.js|initGeetest4""") };
    static Info? Unsup(Page p) => Vendors.Where(v => Regex.IsMatch(p.Srcs + " " + p.Js, v.Item2))  // CapSkip cannot solve these
        .Select(v => new Info(v.Item1, null, new(), Unsupported: true)).FirstOrDefault();
    static Info? Cf(Page p) => Regex.IsMatch(p.Js, """_cf_chl_opt\s*=\s*\{""")  // the "Just a moment..." page, not a widget
        ? Browser("turnstile_challenge", "turnstile", p, "data and pagedata (Cloudflare calls them cData and chlPageData) only exist at run time") : null;
    static Info? Hcaptcha(Page p)  // before reCAPTCHA: a site that moved to hCaptcha may keep the g-recaptcha class
    {
        if (!Regex.IsMatch(p.Srcs + " " + p.Js, """hcaptcha\.com/1/api\.js""")) return null;
        if (Regex.IsMatch(p.Js, """\.setData\s*\(|rqdata"""))  // Enterprise rqdata is issued per challenge
            return Browser("hcaptcha_enterprise", "hcaptcha", p, "rqdata is issued for one challenge at run time");
        var t = Tag("h-captcha", p.H) ?? Tag("g-recaptcha", p.H);
        var key = Or(Attr(t, "data-sitekey"), Grab(SiteKeyJs, Opts("""hcaptcha\.render""", p.Js)));
        if (key == null) return Browser("hcaptcha", "hcaptcha", p, "no sitekey in the static HTML");
        var invisible = Attr(t, "data-size") == "invisible" ? 1 : (int?)null;
        return new("hcaptcha", "hcaptcha", Args(("sitekey", key), ("url", p.Url), ("invisible", invisible)));
    }

    static Info? Recaptcha(Page p)  // Enterprise flag, then v3 (render=KEY), then v2
    {
        var m = Regex.Match(p.Srcs, """/recaptcha/(api|enterprise)\.js(\?\S*)?""");
        if (!m.Success) return null;
        var render = Grab("""[?&]render=([^&\s]+)""", m.Groups[2].Value);  // a v3 key, or "explicit" (a v2 page)
        var t = Tag("g-recaptcha", p.H);
        var o = Opts("""\.render""", p.Js);
        var button = (t ?? "").StartsWith("<button", StringComparison.OrdinalIgnoreCase);
        var action = Attr(t, "data-action");
        var v3 = (render != null && render != "explicit") || (button && !string.IsNullOrEmpty(action));
        var key = Or(render == "explicit" ? null : render, Attr(t, "data-sitekey"), Grab(SiteKeyJs, o));
        if (key == null) return Browser("recaptcha", "recaptcha", p, "no sitekey in the static HTML (set by JavaScript)");
        var small = Attr(t, "data-size") == "invisible" || Grab("""size['"]?\s*:\s*['"](invisible)""", o) != null;
        var invisible = !v3 && (button || small);  // a <button> is invisible v2 unless it has data-action (v3)
        action = Or(action, Grab("""execute\(\s*[^,)]+,\s*\{\s*['"]?action['"]?\s*:\s*['"]([^'"]+)""", p.Js));
        var ent = m.Groups[1].Value == "enterprise";
        var a = Args(("sitekey", key), ("url", p.Url), ("enterprise", ent ? 1 : null), ("version", v3 ? "v3" : null),
                     ("action", v3 ? action : null), ("invisible", invisible ? 1 : null));
        return new("recaptcha_" + (v3 ? "v3" : invisible ? "v2_invisible" : "v2") + (ent ? "_enterprise" : ""), "recaptcha", a);
    }

    static Info? Turnstile(Page p)  // widget only: div.cf-turnstile or turnstile.render
    {
        if (!p.Srcs.Contains("challenges.cloudflare.com/turnstile/v0/api.js")) return null;
        var t = Tag("cf-turnstile", p.H);
        var o = Opts("""turnstile\.render""", p.Js);
        var key = Or(Attr(t, "data-sitekey"), Grab(SiteKeyJs, o));
        if (key == null) return Browser("turnstile", "turnstile", p, "no sitekey in the static HTML");
        var action = Or(Attr(t, "data-action"), Grab("""\baction['"]?\s*:\s*['"]([^'"]+)""", o));
        var cdata = Or(Attr(t, "data-cdata"), Grab("""\bcData['"]?\s*:\s*['"]([^'"]+)""", o));
        return new("turnstile", "turnstile", Args(("sitekey", key), ("url", p.Url), ("action", action), ("data", cdata)));
    }
    static Info? Geetest(Page p)  // v3 only: gt is static, challenge comes from the register endpoint
    {
        if (!Regex.IsMatch(p.Js, """initGeetest\s*\(""") && !Regex.IsMatch(p.Srcs, """/gt(\.[\d.]+)?\.js""")) return null;
        var gt = Grab("""\bgt['"]?\s*:\s*['"]([0-9a-f]{32})""", p.Js);
        var ch = Grab("""\bchallenge['"]?\s*:\s*['"]([0-9a-f]{32,34})""", p.Js);
        return gt == null || ch == null ? Browser("geetest", "geetest", p, "gt and challenge come from the register endpoint")
            : new("geetest", "geetest", Args(("gt", gt), ("challenge", ch), ("url", p.Url)));
    }

    static Info? Altcha(Page p)  // challengeurl / challengejson (v1, v2) or challenge (v3+)
    {
        var t = Grab("""(<altcha-widget\b[^>]*>)""", p.H);
        if (t == null) return null;
        var c = Attr(t, "challenge");
        var json = Or(Attr(t, "challengejson"), (c ?? "").TrimStart().StartsWith('{') ? c : null);
        var url = Or(Attr(t, "challengeurl"), json != null ? null : c);
        return json != null ? new("altcha", "altcha", Args(("url", p.Url), ("challenge_json", json)))
            : url != null ? new("altcha", "altcha", Args(("url", p.Url), ("challenge_url", Abs(p.Url, url))))
            : Browser("altcha", "altcha", p, "no challenge attribute");
    }
    static Info? Capy(Page p)  // the widget script is .../puzzle/get_js/?k=PUZZLE_...
    {
        var m = Regex.Match(p.Srcs, """((?:https?:)?//[^\s"']+?)/puzzle/get_js/\S*?(PUZZLE_[\w-]+)""");
        if (!m.Success) return null;
        var full = m.Groups[1].Value.StartsWith("http") ? m.Groups[1].Value : "https:" + m.Groups[1].Value;
        var host = full == "https://jp.api.capy.me" ? null : full;
        return new("capy", "capy", Args(("sitekey", m.Groups[2].Value), ("url", p.Url), ("api_server", host)));
    }

    const string Mam = "mampkg/@mamdev/core.frontend.libs.captchafox";
    static Info? CaptchaFox(Page p)  // plain build from cdn.captchafox.com, or the bundled build from s.uicdn.com
    {
        var t = Tag("captchafox", p.H);
        var key = Grab("""captchafox[^"']*/api\.js\?key=([^"'&]+)""", p.Srcs);
        if (t == null && key == null) return null;
        var mam = p.Srcs.Contains(Mam) ? "https://s.uicdn.com/" + Mam + "/" : null;
        var sitekey = Or(Attr(t, "data-sitekey"), key);
        if (sitekey == null) return Browser("captchafox", "captchafox", p, "no sitekey in the static HTML");
        return new("captchafox", "captchafox", Args(("sitekey", sitekey), ("url", p.Url), ("api_server", mam)));
    }
    static Info? Friendly(Page p)  // v2 loads @friendlycaptcha/sdk (site.min.js), v1 loads friendly-challenge
    {
        var t = Tag("frc-captcha", p.H);
        if (t == null) return null;
        var e2 = Attr(t, "data-api-endpoint");
        var e1 = Attr(t, "data-puzzle-endpoint");
        if (Attr(t, "data-sitekey") == null) return Browser("friendly_captcha", "friendly_captcha", p, "no sitekey in the static HTML");
        var v2 = e2 != null || Regex.IsMatch(p.Srcs, """friendlycaptcha/sdk|site(\.compat)?\.min\.js""");
        var v1 = e1 != null || Regex.IsMatch(p.Srcs, """friendly-challenge|widget(\.module)?\.min\.js""");
        if (v2 == v1) return Browser("friendly_captcha", "friendly_captcha", p, "cannot tell v1 from v2 in the HTML");
        return new(v2 ? "friendly_captcha_v2" : "friendly_captcha_v1", "friendly_captcha", Args(("sitekey", Attr(t, "data-sitekey")),
            ("url", p.Url), ("version", v2 ? "v2" : "v1"), ("api_server", Or(e2, e1))));
    }

    static Info? Image(Page p)  // a guess: an <img> that says captcha, next to a text box that says captcha
    {
        const string box = """<input\b(?![^>]*type\s*=\s*["']?(?:hidden|checkbox|submit))[^>]*(?:captcha|security.?code)""";
        if (!Regex.IsMatch(p.H, box, RegexOptions.IgnoreCase)) return null;
        foreach (Match m in Regex.Matches(p.H, """<img\b[^>]*>""", RegexOptions.IgnoreCase))
            if (Regex.IsMatch(m.Value, "captcha", RegexOptions.IgnoreCase) && Attr(m.Value, "src") is { Length: > 0 } src)
                return new("image", "normal", Args(("image", Abs(p.Url, src))));
        return null;
    }
    public static Info? Detect(string html, string pageUrl)  // every check runs; the first hit wins, the rest are "also"
    {
        var p = Parse(html, pageUrl);
        var found = new[] { Unsup(p), Cf(p), Hcaptcha(p), Recaptcha(p), Turnstile(p), Geetest(p), Altcha(p), Capy(p), CaptchaFox(p), Friendly(p) }
            .Where(r => r != null).ToList();
        return found.Count == 0 ? Image(p) : found.Count == 1 ? found[0]
            : found[0]! with { Also = found.Skip(1).Select(r => r!.Type).ToArray() };
    }

    public static async Task<SolveResult> Solve(Info i, CapSkipClient s, HttpClient http)
    {
        if (i.Unsupported || i.NeedsBrowser != null) throw new InvalidOperationException(i.NeedsBrowser ?? i.Type + " is not supported by CapSkip");
        if (i.Method == "hcaptcha") return await SolveHcaptcha(i.Args, s, http);
        string K(string k) => (string)i.Args[k]!;  // the positional arguments
        var o = i.Args.Where(kv => kv.Key is not ("sitekey" or "url" or "gt" or "challenge" or "image"))
                      .ToDictionary(kv => kv.Key, kv => kv.Value);  // everything else is an options entry
        return i.Method switch
        {
            "recaptcha" => await s.RecaptchaAsync(K("sitekey"), K("url"), o),
            "turnstile" => await s.TurnstileAsync(K("sitekey"), K("url"), o),
            "geetest" => await s.GeetestAsync(K("gt"), K("challenge"), K("url"), o),
            "altcha" => await s.AltchaAsync(K("url"), o),
            "capy" => await s.CapyAsync(K("sitekey"), K("url"), o),
            "captchafox" => await s.CaptchaFoxAsync(K("sitekey"), K("url"), o),
            "friendly_captcha" => await s.FriendlyCaptchaAsync(K("sitekey"), K("url"), o),
            "normal" => await s.NormalAsync(await ImageData(K("image"), http)),  // fetched with YOUR cookies
            _ => throw new InvalidOperationException("unknown method " + i.Method),
        };
    }
    static async Task<string> ImageData(string src, HttpClient http) => src.StartsWith("data:") ? src
        : "data:image/png;base64," + Convert.ToBase64String(await http.GetByteArrayAsync(src));
    static async Task<SolveResult> SolveHcaptcha(Dictionary<string, object?> a, CapSkipClient s, HttpClient http)
    {   // no SDK call yet: post to in.php and poll res.php at the address the client already uses
        var form = new Dictionary<string, string> { ["method"] = "hcaptcha", ["sitekey"] = (string)a["sitekey"]!,
            ["pageurl"] = (string)a["url"]!, ["invisible"] = a.ContainsKey("invisible") ? "1" : "0", ["json"] = "1" };
        if (a.TryGetValue("data", out var d) && d != null) form["data"] = d.ToString()!;
        var key = string.IsNullOrEmpty(s.ApiKey) ? "" : "&key=" + Uri.EscapeDataString(s.ApiKey);
        if (key != "") form["key"] = s.ApiKey;
        using var sent = await http.PostAsync(s.ApiClient.BaseUrl + "/in.php", new FormUrlEncodedContent(form));
        var job = JsonDocument.Parse(await sent.Content.ReadAsStringAsync()).RootElement;
        var id = job.GetProperty("request").GetString()!;
        if (job.GetProperty("status").GetInt32() != 1) throw new ApiException(id);
        for (var n = 0; n < 36; n++)  // a solve takes 10 to 30 seconds, so give up after 3 minutes
        {
            await Task.Delay(5000);
            var r = JsonDocument.Parse(await http.GetStringAsync($"{s.ApiClient.BaseUrl}/res.php?action=get&id={id}&json=1{key}")).RootElement;
            var value = r.GetProperty("request").GetString()!;
            if (value == "CAPCHA_NOT_READY") continue;
            if (r.GetProperty("status").GetInt32() != 1) throw new ApiException(value);
            return new SolveResult { CaptchaId = id, Code = value, UserAgent = r.TryGetProperty("useragent", out var ua) ? ua.GetString() : null };
        }
        throw new CapSkip.TimeoutException("hCaptcha was not solved within 3 minutes");
    }
}

dotnet run -- "https://example.com/login"

using CapSkip;

var pageUrl = args.Length > 0 ? args[0] : "https://example.com/login";
var http = new HttpClient();  // one client keeps one cookie jar for the page and the image
http.DefaultRequestHeaders.UserAgent.ParseAdd("Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/130.0 Safari/537.36");
Info? info;
try
{
    var page = await http.GetAsync(pageUrl);
    Console.WriteLine((int)page.StatusCode);  // a Cloudflare challenge page arrives as a 403
    var finalUrl = page.RequestMessage!.RequestUri!.ToString();  // the URL after redirects
    info = Detector.Detect(await page.Content.ReadAsStringAsync(), finalUrl);
}
catch (Exception e) when (e is HttpRequestException or InvalidOperationException or TaskCanceledException or NotSupportedException)
{
    Console.WriteLine("Could not fetch the page: " + e.Message);
    return;
}
if (info is null) { Console.WriteLine("No CAPTCHA found."); return; }
Console.WriteLine($"{info.Type} via {info.Method ?? "nothing"}"
    + (info.Also is null ? "" : " (also " + string.Join(", ", info.Also) + ")"));
try
{
    var solver = new CapSkipClient(host: "127.0.0.1", port: 8080);
    var result = await Detector.Solve(info, solver, http);
    Console.WriteLine(result.Code.Length > 80 ? result.Code[..80] + "..." : result.Code);
}
catch (InvalidOperationException e) { Console.WriteLine("Not solvable from this HTML: " + e.Message); }
catch (HttpRequestException e) { Console.WriteLine("Image download failed: " + e.Message); }
catch (CapSkipError e) { Console.WriteLine($"{e.GetType().Name}: {e.Message}"); }

(() => {
  const iframes = [...document.querySelectorAll('iframe')].map((f) => f.src);
  const urls = performance.getEntriesByType('resource').map((r) => r.name).concat(iframes);
  const found = new Map(), add = (o) => found.set(JSON.stringify(o), o);
  for (const u of urls) {
    let m;
    if ((m = u.match(/recaptcha\/(?:api2|(enterprise))\/anchor\?.*?\bk=([\w-]+)/)))
      add({ type: 'recaptcha', sitekey: m[2], enterprise: !!m[1], invisible: /size=invisible/.test(u) });
    else if ((m = u.match(/recaptcha\/(?:api|enterprise)\.js\?.*?\brender=([\w-]+)/)) && m[1] !== 'explicit')
      add({ type: 'recaptcha v3', sitekey: m[1], enterprise: /enterprise\.js/.test(u) });
    else if ((m = u.match(/challenges\.cloudflare\.com\/.*turnstile\/.*\/(0x4[\w-]+|[123]x0+[A-Za-z]+)\//)))
      add({ type: 'turnstile', sitekey: m[1] });
    else if ((m = u.match(/hcaptcha\.com\/captcha\/.*[#&?]sitekey=([\w-]+)/))) add({ type: 'hcaptcha', sitekey: m[1] });
    else if (/arkoselabs\.com\/fc\//.test(u)) add({ type: 'arkose: CapSkip cannot solve' });
  }
  if (window._cf_chl_opt) add({ type: 'cloudflare challenge page' });
  document.querySelectorAll('altcha-widget').forEach((e) => add({ type: 'altcha', challenge: e.getAttribute('challenge') || e.getAttribute('challengeurl') }));
  document.querySelectorAll('.h-captcha[data-sitekey]').forEach((e) => add({ type: 'hcaptcha', sitekey: e.dataset.sitekey }));
  document.querySelectorAll('.frc-captcha, .captchafox').forEach((e) => add({ type: e.classList.contains('captchafox') ? 'captchafox' : 'frc-captcha', sitekey: e.dataset.sitekey }));
  const v3 = [...found.values()].filter((o) => o.type === 'recaptcha v3').map((o) => o.sitekey);  // a v3 badge also adds an invisible anchor frame
  const res = [...found.values()].filter((o) => !(o.type === 'recaptcha' && v3.includes(o.sitekey)));
  return res.length ? res : 'no known CAPTCHA found (GeeTest, Capy and CaptchaFox scripts are not checked)';
})();