Cloudflare captcha [split] prox-config-sidki_2019-01-26b1

[amy]

(Mar. 22, 2022 03:02 AM)cattleyavns Wrote:  Should I share the whole progress ?

I think you've given sufficient information already; on the other hand, browsers' ciphersuites and user-agent strings are not exactly secret either. There's a nice list of their ciphersuites here:

Code:

https://www.ssllabs.com/ssltest/clients.html

Removing the SCSV from OpenSSL requires a patch/recompile (it's hardcoded) so it is not easy to do, but on the other hand, looking through that list, it seems besides bots some older Android and Apple systems will send it. (They might also be using OpenSSL internally.)

The other thing I'm considering is allowing Proxomitron Reborn to use one of the varyingly-compatible forks of OpenSSL like BoringSSL, which is used in e.g. Chrome and doesn't send SCSV. Another alternative is the native Windows Schannel, but it's significantly different in API and would require quite a lot more work. Stock OpenSSL is indeed quite bot-like in its default fingerprint, no doubt because it's a widely used default SSL library for everything---except, unfortunately, most browsers.