Amazon captcha solver

Amazon WAF Captcha

Amazon WAF Captcha also known as AWS WAF Captcha is a part of Intelligent threat mitigation for Amazon AWS

To bypass the captcha you need to grab the following parameters:

• sitekey - is a value of key parameter in the page source
• iv - is a value of iv parameter in the page source
• context - is a value of context parameter in the page source
• challenge_script - the URL of challenge.js script
• captcha_script- the URL of captcha.jsscript
• pageurl - is the full URL of page where you were challenged by the captcha

Request body example:

{
              "key":"1abc234de56fab7c89012d34e56fa7b8",
              "method":"amazon_waf",
              "sitekey":"AQIDAHjcYu/GjX+QlghicBgQ/7bFaQZ+m5FKCMDnO+vTbNg96AHMDLodoefdvyOnsHMRtEKQAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMUX+ZqwwuANRnZujSAgEQgDvHSxUQmVBuyUtumoW2n4ccTG7xQN1r3X/zz41qmQaYv9SSSvQrjIoDXKaUQ23tVb4ii8+uljuRdz/HPA==",
              "pageurl":"https://non-existent-example.execute-api.us-east-1.amazonaws.com/latest",
              "context":"9BUgmlm48F92WUoqv97a49ZuEJJ50TCk9MVr3C7WMtQ0X6flVbufM4n8mjFLmbLVAPgaQ1Jydeaja94iAS49ljb+sUNLoukWedAQZKrlY4RdbOOzvcFqmD/ZepQFS9N5w15Exr4VwnVq+HIxTsDJwRviElWCdzKDebN/mk8/eX2n7qJi5G3Riq0tdQw9+C4diFZU5E97RSeahejOAAJTDqduqW6uLw9NsjJBkDRBlRjxjn5CaMMo5pYOxYbGrM8Un1JH5DMOLeXbq1xWbC17YSEoM1cRFfTgOoc+VpCe36Ai9Kc=",
              "challenge_script":"https://41bcdd4fb3cb.610cd090.us-east-1.token.awswaf.com/41bcdd4fb3cb/0d21de737ccb/cd77baa6c832/challenge.js",
              "captcha_script":"https://41bcdd4fb3cb.610cd090.us-east-1.captcha.awswaf.com/41bcdd4fb3cb/0d21de737ccb/cd77baa6c832/captcha.js",
              "iv":"CgAHbCe2GgAAAAAj",
              "json":1
              }

If everything is OK you will receive the response with your captcha ID {"status":1,"request":"2122988149"} or an error code if your request was incorrect.

Make a 15-20 seconds timeout then submit a HTTP GET request to our API URL: https://api.solvecaptcha.com/res.php to get the result.
The full list of parameters is in the table below.

If captcha is already solved server will respond in the following format:

{
              "status": 1,
              "request": {
              "captcha_voucher":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0aW1lc3RhbXAiOiIyMDIzLTAzLTIwVDEzOjM2OjM3Ljg1Nzk5MjEyMFoiLCJjbGllbnRfaWQiOiIxOTI4NTIzMi1jMTRiLTRlMDUtYjQ2OC02ODBiYjE3ZWNhM2MiLCJkb21haW4iOiJlZnc0N2ZwYWQ5LmV4ZWN1dGUtYXBpLnVzLWVhc3QtMS5hbWF6b25hd3MuY29tIiwiZXhwIjoxNjc5MzE5Mzk3LCJwcm9ibGVtIjoiYmlmdXJjYXRlZHpvbyIsInByb2JsZW1fb3ZlcnJpZGUiOmZhbHNlLCJudW1fc29sdXRpb25zX3Byb3ZpZGVkIjoxfQ.qgSX4tZqZQwXNzVQgVe3OsUMR3vf7-fLWNzZKIHXN-4",
              "existing_token":"25b7ee41-2d4e-46f7-a52e-2d53d10c199a:EQoAf2Zd5kEWAAAA:qGp2oQxLMEny1L7qBP6uRYJ/DRDRL2v50309/M/O7Gul+k1zh6ZqDVGNbrG6LYmUD+4dSYJMNM2IuxgQYbVHp83OwF8p/BgolBwp45CulWxzCjyEGy1/degDo5ivZ8AjFVymUJI/vCq0BOhD4GGZqR8oveOYcUN7OIJy5mtE2reNI92qCiRCqEr8ccZo02DsBDBDQEQOR+q17gQn2vn0Hp3Ss7A="
              }
              }

If captcha is not solved yet server will return CAPCHA_NOT_READY result. Repeat your request in 5 seconds.

If something went wrong server will return an error code.

Use the values returned in your interaction with the target website. Normally the values are sent in the corresponding fields of the POST request, but you definetly need to check how it is used on your case.

List of GET/POST request parameters for https://api.solvecaptcha.com/in.php

Parameter	Type	Required	Description
key	String	Yes	your API key
method	String	Yes	amazon_waf - defines that you're sending Amazon WAF Captcha
sitekey	String	Yes	Value of key parameter you found on the page
iv	String	Yes	Value of iv parameter you found on the page
context	String	Yes	Value of optional context parameter you found on page
pageurl	String	Yes	Full URL of the page where you see the captcha
challenge_script	String	No	The source URL of challenge.js script on the page
captcha_script	String	No	The source URL of captcha.js script on the page
header_acao	Integer Default: 0	No	0 - disabled 1 - enabled. If enabled in.php will include Access-Control-Allow-Origin:* header in the response. Used for cross-domain AJAX requests in web applications. Also supported by res.php.
pingback	String	No	URL for pingback (callback) response that will be sent when captcha is solved. URL should be registered on the server. More info here.
json	Integer Default: 0	No	0 - server will send the response as plain text 1 - tells the server to send the response as JSON
soft_id	Integer	No	ID of software developer. Developers who integrated their software with SolveCaptcha get reward: 10% of spendings of their software users.
proxy	String	No	Format: login:[email protected]:3128 You can find more info about proxies here.
proxytype	String	No	Type of your proxy: HTTP, HTTPS, SOCKS4, SOCKS5.

List of GET request parameters for https://api.solvecaptcha.com/res.php

GET parameter	Type	Required	Description
key	String	Yes	your API key
action	String	Yes	get - get the asnwer for your captcha
id	Integer	Yes	ID of captcha returned by in.php.
json	Integer Default: 0	No	0 - server will send the response as plain text 1 - tells the server to send the response as JSON

Request URL example:

https://api.solvecaptcha.com/res.php?key=1abc234de56fab7c89012d34e56fa7b8&action=get&id=2122988149