突破 Cloudflare 智能盾防护：从无头爬虫失效到 CDP 协议攻防实战

1
+-----------------------------------------------------------+
2
|                      自动化宿主环境                         |
3
+-----------------------------------------------------------+
4
                             |
5
  1. 启动真实 Chrome 实例 (加载持久化 User-Data-Dir Profile)
6
                             |
7
  2. 监听 DevTools 独立端口 (WebSocket Debugger)
8
                             |
9
  3. 建立原生 CDP 客户端 (双向 RPC 协议)
10
                             |
11
  4. 导航至目标站点 -> 触发 Cloudflare 质询
12
                             |
13
            +----------------+----------------+
14
            |                                 |
15
   [自动通过 (2~6秒)]               [需要 Turnstile 交互]
16
            |                                 |
17
            |                       定位 iframe 计算屏幕坐标
18
            |                       分发底层鼠标点击事件
19
            |                                 |
20
            +----------------+----------------+
21
                             |
22
  5. 获取合法的 cf_clearance 会话 Cookie
23
                             |
24
  6. 在页面 DOM 上下文原生地提取所需数据 (零二次请求阻断风险)
25
                             |
26
  7. 结构化清洗 -> 落地同步或执行自动化运维任务

1
import { spawn } from 'node:child_process';
2
import path from 'node:path';
3

4
const profilePath = path.resolve('./tmp/browser-profile');
5
const debuggingPort = 9322;
6

7
const args = [
8
  '--disable-gpu',
9
  '--no-first-run',
10
  '--no-default-browser-check',
11
  // 关键：禁用 Blink 层的自动化受控特征标识
12
  '--disable-blink-features=AutomationControlled',
13
  '--lang=en-US',
14
  '--window-size=1440,1000',
15
  `--remote-debugging-port=${debuggingPort}`,
16
  // 关键：持久化隔离存储，保存历史已通过验证的 Cookie
17
  `--user-data-dir=${profilePath}`,
18
  'about:blank',
19
];
20

21
const chromeProcess = spawn(chromeExecutablePath, args, { stdio: 'ignore' });

1
function createCdpClient(socket) {
2
  let nextId = 0;
3
  const pendingRequests = new Map();
4

5
  socket.addEventListener('message', (event) => {
6
    const message = JSON.parse(event.data);
7
    if (!message.id || !pendingRequests.has(message.id)) return;
8

9
    const { resolve, reject } = pendingRequests.get(message.id);
10
    pendingRequests.delete(message.id);
11

12
    if (message.error) {
13
      reject(new Error(message.error.message));
14
    } else {
15
      resolve(message.result);
16
    }
17
  });
18

19
  return {
20
    send(method, params = {}) {
21
      nextId += 1;
22
      const id = nextId;
23
      return new Promise((resolve, reject) => {
24
        pendingRequests.set(id, { resolve, reject });
25
        socket.send(JSON.stringify({ id, method, params }));
26
      });
27
    },
28
  };
29
}

1
const CHALLENGE_RE = /just a moment|checking your browser|请稍候|verifying you are human/i;
2

3
async function waitForChallengeResolved(client, timeoutMs = 90_000) {
4
  const startTime = Date.now();
5
  let clicked = false;
6

7
  while (Date.now() - startTime < timeoutMs) {
8
    await sleep(1000);
9

10
    // 通过 CDP 执行轻量级 JS 读取当前网页标题
11
    const { result } = await client.send('Runtime.evaluate', {
12
      expression: 'document.title',
13
      returnByValue: true,
14
    });
15
    const title = result.value || '';
16

17
    // 当标题不再包含拦截关键词时，说明质询通过
18
    if (!CHALLENGE_RE.test(title)) {
19
      return true;
20
    }
21

22
    // 若超过设定阈值仍卡在质询页，自动定位 Turnstile 控件并模拟真实物理点击
23
    if (!clicked && Date.now() - startTime > 6000) {
24
      clicked = true;
25
      const box = await getTurnstileCoordinates(client);
26
      if (box) {
27
        // 向 CDP 发送原生硬件级鼠标动作序列
28
        for (const type of ['mouseMoved', 'mousePressed', 'mouseReleased']) {
29
          await client.send('Input.dispatchMouseEvent', {
30
            type,
31
            x: box.x,
32
            y: box.y,
33
            button: 'left',
34
            clickCount: 1,
35
          });
36
          await sleep(100);
37
        }
38
      }
39
    }
40
  }
41
  return false;
42
}