Bypass Cloudflare with Firefox Cookies

[tellu-white]

@back2themoon, you're welcome!

Until now, in every version of this add-on you had to enter "user agent" every time a new page (a new "host") was opened. I made this decision based on the idea that in Firefox there is "general.useragent.override" for certain "hosts" (like in Pale Moon), but today I opened "about:config" in Firefox and found that this is not the case. So, I made a new version of this add-on (2.3) in which the "user agent" has to be entered only once, and this "user agent" is the one in the installed version of Firefox. Each new page ("host") will be opened in Firefox using this "user agent".

EDIT: The idea that Firefox could also use "general.useragent.override" for certain "hosts" was based on the assumption that Firefox displays the "user agent" associated with the active page ("host") when Javascript code is running:

02.png

03.png

*****

Screenshot:

01.png

*****

Download link ( Bypass Cloudflare with Firefox Cookies 2.3 ):

https://www.mediafire.com/file/rhkku0tqcbbm2fv/bypass_cloudflare_with_firefox_cookies_2_3.zip/file

[back2themoon]

That's a neat improvement, thanks. Quick setup guide for those who might want to try this extension: (v.2.3)

1. Install the "Bypass Cloudflare with Firefox Cookies" extension to Pale Moon.
2. Customize/Toolbar and put its icon where you can click it.
3. Ctrl+Shift+click on the icon, point it to firefox.exe in your Firefox installation folder.
4. Alt+Shift+click on the icon, point it to cookies.sqlite in your Firefox profile folder.
5. Go to your updated Firefox, create a new bookmark, name it "Get user agent string" (or whatever you want). The URL:

Code: Select all

javascript:void(prompt('navigator.userAgent',navigator.userAgent))

6. Click on the Bookmark (aka Bookmarklet) and copy the user agent string it'll give you.
7. Back to Pale Moon: Ctrl+Alt+Shift+click on the icon. Paste the above string.

The above steps form the initial, one-time setup. Now let's deal with a problem website.

1. Copy its URL, Alt+click on the extension's icon, paste the URL and click OK.
2. The website opens in Firefox. Pass the malicious Cloudflare checks, and log in to the website, if required.
3. Back to Pale Moon: Shift+Click on the icon. Click OK and that's it.

You can either just click on the icon, or visit the website with your preferred method. It should work. Repeat the last steps above (1-3) for other problem websites.

[tellu-white]

Quick setup guide for those who might want to try this extension ...

Thank you back2themoon for your contribution.

*****

I've made a new version (3.0) of this add-on with some improvements and a bugfix (options remain unchanged so the HELP posted by back2themoon remains valid).

The bugfix is the following: in version 2.3 it was not possible to change the Firefox "user agent" already entered in the add-on settings. This is a problem because if you update Firefox then its user agent is also updated so it has to be re-entered in add-on settings.

I've also made two improvements:

1. The add-on checks if the Firefox app and the "cookies.sqlite" file have been correctly selected (checks their names). In case of errors, a message is displayed and the process is stopped. The user will have to repeat this procedure.

Screenshots:

01.png

02.png

2. In the new version (3.0), the add-on removes the "general.useragent.override.XXX" entries from "prefs.js" when uninstalled (they no longer need to be manually removed). The add-on will ONLY remove the entries that it made or modified itself.

Screenshots:

03.png

04.png

05.png

*****

Download link ( Bypass Cloudflare with Firefox Cookies 3.0 ):

https://www.mediafire.com/file/esxo1skz2fy2pi5/bypass_cloudflare_with_firefox_cookies_3_0.zip/file

[PapaiMark]

Works for me. Thank you.
For portable FF, I pointed to the ..\FirefoxPortable\App\Firefox64\firefox.exe

Just noob questions:

Once there are many sites using cloudflare...
Can I do it for many sites or one at a time?

If I delete cookies on FF, it will still work here on PM?
(will the cookie info be stored somewhere in PM?)

If yes, deleting PM cookies will erase the extention info?

Could it be done directly to the cloudflare site that is called from the desired individual site?
( tested with other site and PM crashed)

[back2themoon]

Can I do it for many sites or one at a time?

One at a time.

If I delete cookies on FF, it will still work here on PM? (will the cookie info be stored somewhere in PM?)

Yes.

If yes, deleting PM cookies will erase the extention info?

Initial extension setup will not be deleted I assume, but you'll have to re-import the working cookies from Firefox for each problem website.

Could it be done directly to the cloudflare site that is called from the desired individual site?( tested with other site and PM crashed)

Not sure what you mean here, but if Pale Moon crashes then Alt+click on the extension icon to open the problem website directly on Firefox first.

[tellu-white]

PapaiMark wrote :
If I delete cookies on FF, it will still work here on PM? ... If yes, deleting PM cookies will erase the extention info?

https://forum.palemoon.org/viewtopic.php?f=71&t=32098&start=20#p259894

The add-on doesn't save cookies that it reads from the Firefox file "cookies.sqlite" but only inserts them into Pale Moon. If cookies are not deleted in Pale Moon then they remain valid (for the respective host). As I said before, after a certain time cookies lose their validity (I don't know after how long and if this is true for all problem pages). When this happens, cookies have to be retrieved from Firefox again (for that page) - AFTER that page has been successfully reloaded in Firefox. This is the reason why the add-on does not save cookies (in "prefs.js").

Cookies didn't lose their validity because of the "cookie.expires" parameter. I changed the value of this parameter by adding one year to the given value. Also, the "cookie.isSession" parameter is set to "false".

The information that this add-on saves in the "prefs.js" file is the following:

1. Firefox app path
2. "cookies.sqlite" Firefox file path
3. INSTALLED Firefox "user agent"
4. "general.useragent.override.XXX" = "user agent of INSTALLED Firefox" - where XXX is the "hostname" of the problem page
5. "hostnames" (XXXs) for which "general.useragent.override.XXX" has been set

PapaiMark wrote :
Could it be done directly to the cloudflare site that is called from the desired individual site?

https://forum.palemoon.org/viewtopic.php?f=71&t=32098&start=20#p259894

The purpose of this add-on is to bypass Cloudflare (in Pale Moon) so the answer to your question is no.

[back2themoon]

@tellu-white, a minor suggestion, in case you update it again.

In the Add-ons Manager, https://addons.palemoon.org/extensions/ is listed as the extension's home page. This is obviously inaccurate. Putting this topic as "Homepage" would be correct and more helpful for future users trying to locate it.

[billmcct]

If I delete cookies on FF, it will still work here on PM?
(will the cookie info be stored somewhere in PM?)

You can use CookieKeeper from the CAA to protect cookies you want to keep.
The drawback is that you will have to use CookieKeeper UI to delete cookies.

caa:addon/cookiekeeper

[tellu-white]

@tellu-white, a minor suggestion, in case you update it again.

In the Add-ons Manager, https://addons.palemoon.org/extensions/ is listed as the extension's home page. This is obviously inaccurate. Putting this topic as "Homepage" would be correct and more helpful for future users trying to locate it.

I'm doing a minor bugfix update (version 3.1) so I'll also implement your suggestion regarding the extension's home page.

*****

Download link ( Bypass Cloudflare with Firefox Cookies 3.1 ):

https://www.mediafire.com/file/bcm405x7gziplpe/bypass_cloudflare_with_firefox_cookies_3_1.zip/file

[tellu-white]

I've made a new version of this add-on (4.0) with two important improvements:

1. I have added code used by the "Intercept & Modify HTTP Response" add-on, so that I will remove incoming responses from Cloudflare with the following filter:

[`/cloudflare/`, `/\/.*/`, [`/.*/`, ``]]

This will stop Cloudflare blocking Pale Moon and make it possible to use the "Ctrl + Click on Button" option to open the "problem page" in Firefox.

01.png

Pale Moon didn't freeze although it took quite a while before I took a screenshot which I edited.
Then I used the "Ctrl + Click on Button" option and opened the URL of the current page in Firefox:

02.png

After I passed the Cloudflare check and the page loaded successfully, I closed Firefox and got cookies in Pale Moon with the "Shift + Click on Button" option, just like in the previous version of the add-on.

What has changed in this version is the different behavior of the "Click on Button" option (see below). So, in order to open the page for which I got cookies from Firefox in the above steps, I'll have to use either "url bar" or a bookmark:

03.png

04.png

2. The second improvement I've made in this version of the add-on is saving cookies in the "prefs.js" file. This will make possible to delete cookies in Pale Moon because they can be reloaded from the "prefs.js" file. This option will be available until the cookies lose their validity (see explanation in a previous post). However, when the cookies lose their validity, Cloudflare will no longer freeze Pale Moon due to the first enhancement, described above. At that point you will have to repeat the process of copying cookies from Firefox.

Delete cookies in Pale Moon:

05.png

06.png

"Click on Button" option = Enter URL + Reload cookies from the "prefs.js" file + Open page:

07.png

08.png

09.png

*****

Download link ( Bypass Cloudflare with Firefox Cookies 4.0 ):

https://www.mediafire.com/file/jvgvfz0et8r3qa8/bypass_cloudflare_with_firefox_cookies_4_0.zip/file

[tellu-white]

Starting with version 3.0, the add-on checks if the Firefox app and the "cookies.sqlite" file have been selected correctly (checks their names). But I omitted to accept the name of the Firefox Portable app which is "FirefoxPortable.exe" and not "firefox.exe" (in Windows). I have fixed this in version 4.1 of this add-on.

*****

Download link ( Bypass Cloudflare with Firefox Cookies 4.1 ):

https://www.mediafire.com/file/qq0olbt8smuw0d4/bypass_cloudflare_with_firefox_cookies_4_1.zip/file

[tellu-white]

This version (4.2) is a bugfix. When cookies lose their validity for a specific page (a specific "host") and are fetched from Firefox again, they will be saved again in the Pale Moon "prefs.js" file. In previous versions of the add-on I didn't delete from "prefs.js" file cookies that became invalid. In addition to the fact that they unnecessarily increase the length of the cookies string, they can also create problems in correctly selecting the valid cookies. I've fixed this bug in this version.

*****

Download link ( Bypass Cloudflare with Firefox Cookies 4.2 ):

https://www.mediafire.com/file/9mlh15bng82z5s5/bypass_cloudflare_with_firefox_cookies_4_2.zip/file

[dinosaur]

Starting with version 3.0, the add-on checks if the Firefox app and the "cookies.sqlite" file have been selected correctly (checks their names). But I omitted to accept the name of the Firefox Portable app which is "FirefoxPortable.exe" and not "firefox.exe" (in Windows). I have fixed this in version 4.1 of this add-on.

Why the hell do you want to restrict the browser to just Firefox ???

FYI, I'm using your extension (*) with Waterfox (under Linux), and it works beautifully with it...

Please allow using Firefox forks, if this fancies us... I.e. remove this silly executable name check, please.

Also, please, offer an option to NOT rewrite HTTP response for Cloudflare: I prefer to use uBlock to block turnstile checks (and only them), so that not all Cloudflare sites (the ones NOT using turnstile) get blocked and require me to use your extension while it is not needed.

---------
(*) v2.3 because the changes in the newer versions are breakages, as far as I am concerned.

[tellu-white]

dinosaur wrote :
Why the hell do you want to restrict the browser to just Firefox ???
FYI, I'm using your extension (*) with Waterfox (under Linux), and it works beautifully with it...

https://forum.palemoon.org/posting.php?mode=reply&f=71&t=32098#pr260027

Initially I wanted to read cookies from the "Cookies" file of Google Chrome. This was not possible because in that file in the "value" column there is no saved data. There is a column with the name "encrypted_value" with saved data but it can only be read with an add-on made for Google Chrome.

SQL Query in Firefox:

Code: Select all

var query = "SELECT host, path, name, value, isSecure, isHttpOnly, expiry FROM moz_cookies";

Result in Firefox:

cookie.host = .drunkenslug.com
cookie.path = /
cookie.name = cf_clearance
cookie.value = v1gDdzdTDrnaNGG_hiM2rBkIjN3kJcBoKrqXqpUwtxY-1740310853-1.2.1.1-y69QhvOGCs1uoiO_MDXeYEBi88QiA.NW4XSOjayR5toY4W6IQJGOGsyXtfn_Kx2vjQZzdKLtORhqaifJeOPk8pbpTFEGUzXHkaruJli114hxR87Ad8tA4PecEdI6J6thhhTaSHkGaPN1tdIXD9RS0meOD4T.EXCQUYQiCRdD7U02fAWbPLMqu2g5teilfHfrZzlvQPofdcmxqwVEKu5nLyLbPf8lI_AhRqpUTabWQJi5mWdL5aIJ66w_GizXYgUI4zTgglRkFH4b9CvdHkxvcueWygp0JIkpxvXAeq1a88q0PENAfV1w4rRuHYLp_WMAhVc5rkjGd8eGsufX9CdJzg
cookie.isSecure = 1
cookie.isHttpOnly = 1
cookie.isSession = false
cookie.expires = 1771846853

SQL Query in Google Chrome:

Code: Select all

var query = "SELECT host_key, path, name, value, is_secure, is_httponly, expires_utc FROM cookies";

Result in Google Chrome:

Code: Select all

cookie.host = .drunkenslug.com
cookie.path = /
cookie.name = cf_clearance
cookie.value = 
cookie.isSecure = 1
cookie.isHttpOnly = 1
cookie.isSession = false
cookie.expires = 13416320322195930

As you can see, there are differences between browsers regarding the databases used to save cookies. Since I don't have the possibility to test all existing browsers, I decided to limit the add-on code to the Firefox database.

You say that my add-on also works in Waterfox. Please post the name of the cookie (database) file that Waterfox uses so that I can remove the restriction in selecting it. As for the name of the browser app (executable), I can remove the name restriction but the add-on will only work with databases whose names are supported. I can't let database files like the one in Google Chrome be selected, for obvious reasons.

dinosaur wrote :
Also, please, offer an option to NOT rewrite HTTP response for Cloudflare: I prefer to use uBlock to block turnstile checks (and only them), so that not all Cloudflare sites (the ones NOT using turnstile) get blocked and require me to use your extension while it is not needed.

https://forum.palemoon.org/posting.php?mode=reply&f=71&t=32098#pr260027

After I will receive from you the name of the cookie (database) file that Waterfox is using, I will make an update in which I will also include the option to disable rewriting of the HTTP response.

[Moonchild]

Off-topic:

Initially I wanted to read cookies from the "Cookies" file of Google Chrome. This was not possible because in that file in the "value" column there is no saved data. There is a column with the name "encrypted_value" with saved data but it can only be read with an add-on made for Google Chrome.

I wonder why Google Chrome insists on encrypting its cookies. Afraid a casual reader could see how much tracking information Google stores?

[tellu-white]

I wonder why Google Chrome insists on encrypting its cookies. Afraid a casual reader could see how much tracking information Google stores?

Funny thing! This is exactly what I was thinking

[dinosaur]

You say that my add-on also works in Waterfox. Please post the name of the cookie (database) file that Waterfox uses so that I can remove the restriction in selecting it. As for the name of the browser app (executable), I can remove the name restriction but the add-on will only work with databases whose names are supported. I can't let database files like the one in Google Chrome be selected, for obvious reasons.

Waterfox is a fork of Firefox: it uses exactly the same database file name and the same MySQL database format as Firefox.

If you want to validate a browser, do NOT do it on the executable name (under Linux, this name could also be changed for the name of a wrapper script (*), so this is unpredictable an unreliable a way to check for compatibilty).

If you (really) want to validate a browser choice, do it on the database format instead...
But you know, PM users are computer-literate enough to be let the leeway to choose and experience by themselves. Simply state in your add-on doc that you only support Firefox cookies database format, and leave it to the PM user to take their own responsibilities...

(*) Using a wrapper script might even be a requirement, so to be able to set environment variables for compatibility reasons (e.g. LD_PRELOAD, LANG, LD_LIBRARY_PATH, MOZ_ENABLE_WAYLAND, etc) before launching the actual viewer binary.

[andyprough]

Off-topic:

I wonder why Google Chrome insists on encrypting its cookies. Afraid a casual reader could see how much tracking information Google stores?

Afraid that every malware writer in the world could extract all of Google's tracking data and instantly pwn people's bank accounts, retirement accounts, credit cards, etc? Because Google keeps your security codes, PIN codes, 2FA codes, account numbers, etc, etc?

[Moonchild]

Off-topic:

Afraid that every malware writer in the world could extract all of Google's tracking data and instantly pwn people's bank accounts, retirement accounts, credit cards, etc? Because Google keeps your security codes, PIN codes, 2FA codes, account numbers, etc, etc?

If they get the cookie store, that level of obscurity won't help anyway since you can just plug it into a chromium back-end to recover it. So at most it'd be surface level obscurity which isn't security.

[tellu-white]

@dinosaur

I made version 5.0 of this add-on in which I removed the checking of the browser name and the "sqlite" file's name. However, if the database with cookies is not compatible with the following query:

Code: Select all

var query = "SELECT host, path, name, value, isSecure, isHttpOnly, expiry FROM moz_cookies";

the add-on will stop working and will display the following message:

The selected "Cookie Database" file is not a "sqlite" one, or the database in the selected "sqlite" file is not compatible with this add-on.

01.png

In this version I've also added the option to disable "HTTP Observer" for those who want to use the "uBlock Origin" add-on instead. Enabling and disabling "HTTP Observer" is done by right-clicking on the add-on button. The default setting is with "HTTP Observer" enabled, since not all users have "uBlock Origin" installed. The "HTTP Observer" setting is saved in "prefs.js" so it doesn't change when restarting Pale Moon.

Screenshots:

02.png

03.png

04.png

05.png

*****

Download link ( Bypass Cloudflare with Firefox Cookies 5.0 ):

https://www.mediafire.com/file/s3r4bdmlzcssybx/bypass_cloudflare_with_firefox_cookies_5_0.zip/file