Nuclei Blocked by Cloudflare

[gauravnarwani97]

I'm writing a template when on debug flag enabled am getting an response which shows that I'm blocked by Cloudflare. Any tips on how do we bypass this protection

Response:

HTTP/1.1 403 Forbidden
Connection: close
Transfer-Encoding: chunked
Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Cf-Ray: 70328300bf2d85c0-BOM
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 28 Apr 2022 20:22:44 GMT
Expect-Ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Referrer-Policy: same-origin
Server: cloudflare
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN

<title>Access denied</title> <script>

[ehsandeep]

@gauravnarwani97 I'm able to run nuclei -u https://hackerone.com which is behind Cloudflare without any error, it is possible the block is because of the payload used in the template and Cloudflare WAF responded with 403 which is expected, or have you confirmed that you are able to make the same request from curl and only getting blocked when using nuclei?

[gauravnarwani97]

It is blocked by curl and nuclei. Needs captcha to unlock. What can we do here?

[forgedhallpass]

You can try sending your payload through a browser's developer tools, either by using the edit and resend functionality within the network tab e.g. in Firefox, or by using the Fetch API/XMLHttpRequest within the JavaScript console. If your request will be blocked, then probably either your payload is causing it, or there is an IP white/blacklisting in place. If the requests are not blocked from there, it might be because of certificate verification, or white/blackilst TLS signature based rules. If it is the former, then try using a certificate signed by a verified authority (see nuclei -help for the relevant flags), if it is the latter, then we'd need a host where we could do some testing, or the firewall rule(s) that block the requests, so we could also reproduce it ourselves.