如何在 PHP 中用 cURL cookie 文件识别 AWS WAF 验证码

mkdir waf-demo
cd waf-demo
composer require capskip/capskip

<?php
// waf.php: Steps 1 to 4 go into this one file, in order.
require __DIR__ . '/vendor/autoload.php';

const PAGE_URL = 'https://www.example.com/'; // the page that answers HTTP 405
const JAR = __DIR__ . '/waf-cookies.txt';    // the token store, shared by every PHP process

// One cURL handle per request, freed when the function returns.
function request(string $url, array $options = []): array
{
    $ch = curl_init($url);
    curl_setopt_array($ch, $options + [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 30,
        CURLOPT_USERAGENT => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/130.0 Safari/537.36',
    ]);
    $body = curl_exec($ch);
    if ($body === false) {
        throw new RuntimeException(curl_error($ch));
    }
    return [curl_getinfo($ch, CURLINFO_RESPONSE_CODE), $body];
}

// A page fetch only reads the jar, so it sends whatever token is in the file.
function fetch(string $url): array
{
    return request($url, [
        CURLOPT_COOKIEFILE => JAR,
        CURLOPT_HTTPHEADER => ['Accept: text/html'], // cURL sends */* unless told otherwise
    ]);
}

// The five values on an AWS WAF CAPTCHA page, or null for any other response.
function read_challenge(int $status, string $html): ?array
{
    if ($status !== 405 || !str_contains($html, 'gokuProps')) {
        return null;
    }
    preg_match('/gokuProps\s*=\s*\{(.*?)\}/s', $html, $block);
    $field = fn (string $name): ?string =>
        preg_match('/"' . $name . '"\s*:\s*"([^"]+)"/', $block[1] ?? '', $m) ? $m[1] : null;
    $script = fn (string $name): ?string =>
        preg_match('/<script[^>]+src="([^"]+\/' . $name . '\.js)"/', $html, $m) ? $m[1] : null;

    $found = [
        'sitekey' => $field('key'),
        'iv' => $field('iv'),
        'context' => $field('context'),
        'challenge_script' => $script('challenge'),
        'captcha_script' => $script('captcha'),
    ];
    return in_array(null, $found, true) ? null : $found;
}

use CapSkip\CapSkip;

// Local mode. In Server mode, use your server's address instead.
$solver = new CapSkip(['host' => '127.0.0.1', 'port' => 8080]);

function solve(CapSkip $solver, array $challenge): array
{
    // The answer is a voucher pair, not a token.
    return $solver->amazonWaf($challenge['sitekey'], PAGE_URL, [
        'iv' => $challenge['iv'],
        'context' => $challenge['context'],
        'challenge_script' => $challenge['challenge_script'],
        'captcha_script' => $challenge['captcha_script'],
    ]);
}

// Trade the voucher pair for the aws-waf-token value.
function exchange(array $result, array $challenge): string
{
    // The voucher endpoint sits beside challenge.js, same folder.
    $script = $challenge['challenge_script'];
    $voucherUrl = substr($script, 0, strrpos($script, '/')) . '/voucher';
    $site = parse_url(PAGE_URL);
    $origin = $site['scheme'] . '://' . $site['host'] . (isset($site['port']) ? ':' . $site['port'] : '');

    [$status, $body] = request($voucherUrl, [
        CURLOPT_POST => true,
        CURLOPT_FOLLOWLOCATION => true, // a regional host may redirect to the real one
        CURLOPT_POSTFIELDS => json_encode([
            'captcha_voucher' => $result['captcha_voucher'],
            'existing_token' => $result['existing_token'],
        ]),
        CURLOPT_HTTPHEADER => [
            'Content-Type: text/plain;charset=UTF-8', // PHP would send a form type otherwise
            'Origin: ' . $origin,
            'Referer: ' . $origin . '/',
        ],
    ]);
    if ($status !== 200) {
        throw new RuntimeException("voucher exchange failed: HTTP $status");
    }
    return json_decode($body, true, 512, JSON_THROW_ON_ERROR)['token'];
}

// The only writer of the jar. It keeps every other line and replaces the old token.
function save_token(string $token): void
{
    $lines = is_file(JAR) ? file(JAR, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) : [];
    $lines = array_filter($lines, fn (string $line) => !str_contains($line, "\taws-waf-token\t"));
    // Netscape format: host, subdomains, path, secure, expiry (0 = session), name, value
    $lines[] = parse_url(PAGE_URL, PHP_URL_HOST) . "\tFALSE\t/\tFALSE\t0\taws-waf-token\t" . $token;
    file_put_contents(JAR, implode("\n", $lines) . "\n", LOCK_EX);
}

use CapSkip\Exceptions\ApiException;

function fetch_protected(CapSkip $solver): array
{
    [$status, $html] = fetch(PAGE_URL); // sends the token in the jar, if there is one
    if (read_challenge($status, $html) === null) {
        return [$status, $html];
    }

    $lock = fopen(JAR . '.lock', 'c');
    flock($lock, LOCK_EX); // one solve at a time across processes, released when $lock is freed
    for ($attempt = 1; ; $attempt++) {
        [$status, $html] = fetch(PAGE_URL); // the process we waited for may have saved a token
        $challenge = read_challenge($status, $html);
        if ($challenge === null) {
            return [$status, $html];
        }
        if ($attempt > 3) {
            throw new RuntimeException('AWS WAF CAPTCHA not solved in 3 attempts');
        }
        try {
            save_token(exchange(solve($solver, $challenge), $challenge)); // exchange at once
        } catch (ApiException $e) {
            echo "attempt $attempt: {$e->getMessage()}\n"; // each retry draws a new puzzle
        }
    }
}

[$status, $body] = fetch_protected($solver);
echo $status, ' ', substr($body, 0, 60), "\n";

// Web copy of waf.php: replace its last two lines with this read-only check.
// Solving stays with "php waf.php", run from a scheduled task.
[$status, $html] = fetch(PAGE_URL);
if (read_challenge($status, $html) !== null) {
    http_response_code(503);
    header('Retry-After: 60');
    exit('No valid token yet, try again soon.');
}
http_response_code($status);
echo substr($html, 0, 60);