Sophomoresty/turnstile-bypass

What it solves

It provides a way to bypass Cloudflare's Turnstile widgets and interstitial "Just a moment" waiting rooms that block automated access to websites. It specifically targets the challenge layers that require a user to prove they are human, allowing a script to obtain a valid session token or a cf_clearance cookie to access the real origin site.

How it works

The tool drives a headed Google Chrome or Chromium browser instance. It uses a custom Chrome extension (Manifest V3) to patch MouseEvent.screenX/Y coordinates, which prevents Cloudflare from detecting the browser as a bot based on how clicks are performed via the Chrome DevTools Protocol (CDP). It can operate through different "lanes" (execution paths), including DrissionPage, agent-browser-cli (via Node), or YesCaptcha as a last resort.

Who it’s for

Developers and automation engineers who need to programmatically access websites protected by Cloudflare's bot detection systems without being blocked by the challenge pages.

Highlights

• Multi-platform support: Works on macOS, Windows, and Linux (including headless Linux via xvfb).
• Two-layer bypass: Handles both the Turnstile widget on a page and the full-page interstitial waiting room.
• Custom Patching: Includes a built-in extension to fix CDP click coordinates to avoid bot detection.
• Client-side execution: Runs in a headed browser to maintain a high success rate, avoiding the common pitfalls of headless Chrome.
• Flexible lanes: Supports multiple browser automation frameworks for solving challenges.