[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7DEZF4T3WJSVC10CCNNT0BV":3,"skill-same:01M7DEZF4T3WJSVC10CCNNT0BV":50},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":14,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":35,"install":36,"resources":49},"01M7DEZF4T3WJSVC10CCNNT0BV","stealth-infra",null,"Anti-bot evasion, proxy rotation, credential retrieval from password managers, and stealth HTTP tooling for covert web operations.","Akapi895\u002Fraptix","Akapi895","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F83953516?v=4","01M7DEGNDGERR4F4YETDFVA512","Phạm Anh Tuấn","01M7DEGNEHYZNA920AYM5EH7H8",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fshared\u002Fstealth-infra\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: stealth-infra\ndescription: \"Anti-bot evasion, proxy rotation, credential retrieval from password managers, and stealth HTTP tooling for covert web operations.\"\nallowed-tools: Bash Read\nmetadata:\n  subdomain: opsec\n  when_to_use: \"stealth, anti-bot, captcha, Cloudflare bypass, WAF evasion, proxy rotation, cookie injection, password manager, keyring, 1Password, GNOME Keyring, OPSEC quiet, anti-detection, TLS fingerprint, browser impersonation\"\n  tags: stealth, proxy, captcha, anti-bot, opsec, cookies, keyring\n  mitre_attack: T1562, T1036, T1090\n---\n\n# Stealth Infrastructure — Anti-Bot Evasion & Covert Operations\n\nThis skill covers the stealth tooling installed in the sandbox for evading anti-bot systems, rotating proxies, solving CAPTCHAs, and retrieving credentials from password managers. Use these tools when the engagement RoE specifies OPSEC level `quiet` or `silent`, or when targets deploy WAFs\u002Fanti-bot shields.\n\n## Available Libraries (Pre-Installed)\n\n| Library | Purpose | When to use |\n|---------|---------|-------------|\n| **scrapling** | Adaptive scraping with Cloudflare Turnstile bypass, StealthyFetcher | Primary choice for any anti-bot-protected target |\n| **curl_cffi** | libcurl with impersonated TLS fingerprints (Chrome\u002FFirefox\u002FSafari) | When you need raw HTTP with real browser TLS |\n| **tls_client** | Go-based TLS fingerprint impersonation via Python | Alternative to curl_cffi for different fingerprint profiles |\n| **cloudscraper** | Cloudflare v1\u002Fv2 challenge solver | Legacy Cloudflare JS challenges |\n| **fake-useragent** | Realistic, rotating User-Agent strings | Any HTTP request needing normal-looking UA |\n| **proxychains4** | Force any CLI tool through a SOCKS\u002FHTTP proxy chain | Route nmap\u002Fcurl\u002Fsubfinder through Tor or proxy |\n| **tor** | Onion routing for IP anonymization | When source IP must not be linkable to operator |\n| **keyring** | OS keyring access (GNOME Keyring, macOS Keychain, Windows Credential Vault) | Retrieve stored credentials without hardcoding |\n| **python-socks** | SOCKS4\u002F5 proxy support for asyncio | Async HTTP through proxies |\n| **aiohttp-socks** | aiohttp + SOCKS proxy integration | Async scraping through proxy chains |\n\n## 1. Scrapling — Primary Anti-Bot Bypass\n\nScrapling's `StealthyFetcher` uses a real Chromium instance with anti-fingerprinting patches. It bypasses Cloudflare Turnstile, Akamai, DataDome, and most JS challenges.\n\n```python\n# Stealthy fetch — bypasses Cloudflare Turnstile and most anti-bot\ntimeout 60 python3 -u -c '\nfrom scrapling.fetchers import StealthyFetcher\n\npage = StealthyFetcher.fetch(\n    \"https:\u002F\u002F\u003CTARGET>\",\n    headless=True,\n    network_idle=True,\n    disable_resources=True,  # skip images\u002Ffonts for speed\n)\nprint(f\"Status: {page.status}\")\nprint(f\"Title: {page.css(\\\"title::text\\\").get()}\")\n# Extract data\nfor link in page.css(\"a[href]\"):\n    print(f\"  {link.attrib[\\\"href\\\"]}\")\n' 2>&1 | tee scrapling_result.txt\n```\n\n### With proxy rotation:\n```python\ntimeout 60 python3 -u -c '\nfrom scrapling.fetchers import StealthyFetcher\n\npage = StealthyFetcher.fetch(\n    \"https:\u002F\u002F\u003CTARGET>\",\n    headless=True,\n    network_idle=True,\n    proxy={\"server\": \"socks5:\u002F\u002F127.0.0.1:9050\"},  # Tor\n)\nprint(page.status, page.css(\"title::text\").get())\n'\n```\n\n### Session persistence (cookies survive across requests):\n```python\ntimeout 60 python3 -u -c '\nfrom scrapling.fetchers import StealthyFetcher\n\n# First request — login\nfetcher = StealthyFetcher()\npage = fetcher.fetch(\"https:\u002F\u002F\u003CTARGET>\u002Flogin\", headless=True)\n# Fill and submit login form...\n\n# Second request — authenticated, same session\npage2 = fetcher.fetch(\"https:\u002F\u002F\u003CTARGET>\u002Fdashboard\", headless=True)\nprint(page2.css(\"h1::text\").get())\n'\n```\n\n## 2. curl_cffi — TLS Fingerprint Impersonation\n\nReal browser TLS fingerprints without running a browser. Fastest option for API probing.\n\n```python\ntimeout 30 python3 -u -c '\nfrom curl_cffi import requests\n\n# Impersonate Chrome 131\nr = requests.get(\n    \"https:\u002F\u002F\u003CTARGET>\",\n    impersonate=\"chrome131\",\n    timeout=10,\n)\nprint(f\"Status: {r.status_code}\")\nprint(f\"Server: {r.headers.get(\\\"server\\\", \\\"?\\\")} | CF-RAY: {r.headers.get(\\\"cf-ray\\\", \\\"none\\\")}\")\nprint(r.text[:500])\n'\n```\n\n### With proxy:\n```python\nr = requests.get(\n    \"https:\u002F\u002F\u003CTARGET>\",\n    impersonate=\"chrome131\",\n    proxies={\"https\": \"socks5:\u002F\u002F127.0.0.1:9050\"},\n    timeout=10,\n)\n```\n\n### Available impersonation profiles:\n- `chrome99` through `chrome131`\n- `firefox109`, `firefox133`\n- `safari15_3`, `safari18_0`\n- `edge99`, `edge101`\n\n## 3. Proxy Infrastructure\n\n### Proxychains (route any CLI tool through proxy)\n\n```bash\n# Start Tor (if not running)\ntor &\nsleep 5\n\n# Route curl through Tor\nproxychains4 curl -s https:\u002F\u002Fcheck.torproject.org\u002Fapi\u002Fip\n\n# Route any scanner through Tor\nproxychains4 subfinder -d \u003CTARGET> -silent\nproxychains4 httpx-pd -l subdomains.txt -silent\n```\n\n### Free proxy rotation (Proxifly)\n\n```bash\n# Download fresh proxy list\ncurl -sL https:\u002F\u002Fcdn.jsdelivr.net\u002Fgh\u002Fproxifly\u002Ffree-proxy-list@main\u002Fproxies\u002Fprotocols\u002Fhttps\u002Fdata.json -o proxies.json\n\n# Use in Python\ntimeout 30 python3 -u -c '\nimport json, random\nfrom curl_cffi import requests\n\nwith open(\"proxies.json\") as f:\n    proxies = json.load(f)\n\n# Pick a random proxy\nproxy = random.choice(proxies)\nproxy_url = f\"{proxy[\\\"protocol\\\"]}:\u002F\u002F{proxy[\\\"ip\\\"]}:{proxy[\\\"port\\\"]}\"\nprint(f\"Using proxy: {proxy_url} ({proxy.get(\\\"country\\\", \\\"?\\\")})\")\n\nr = requests.get(\n    \"https:\u002F\u002F\u003CTARGET>\",\n    impersonate=\"chrome131\",\n    proxies={\"https\": proxy_url},\n    timeout=10,\n)\nprint(f\"Status: {r.status_code}\")\n'\n```\n\n### Custom proxy chain (edit \u002Fetc\u002Fproxychains4.conf)\n\n```bash\n# For OPSEC-quiet: chain through your VPN + Tor\ncat > \u002Ftmp\u002Fchain.conf \u003C\u003C 'EOF'\nstrict_chain\nproxy_dns\n[ProxyList]\nsocks5 \u003CYOUR_VPN_SOCKS_IP> \u003CPORT>\nsocks5 127.0.0.1 9050\nEOF\nproxychains4 -f \u002Ftmp\u002Fchain.conf curl -s https:\u002F\u002F\u003CTARGET>\n```\n\n## 4. Credential Retrieval from Password Managers\n\n### Python keyring (generic — works with GNOME Keyring, macOS Keychain, KWallet)\n\n```python\ntimeout 10 python3 -u -c '\nimport keyring\n\n# Retrieve stored credential\npassword = keyring.get_password(\"telenor-vdp\", \"test-user\")\nif password:\n    print(f\"Retrieved password for test-user: {password[:3]}***\")\nelse:\n    print(\"No credential stored. Use: keyring.set_password(\\\"telenor-vdp\\\", \\\"test-user\\\", \\\"\u003Cpassword>\\\")\")\n'\n```\n\n### Store credentials for the engagement:\n\n```python\ntimeout 10 python3 -u -c '\nimport keyring\nkeyring.set_password(\"telenor-vdp\", \"test-user\", \"\u003CPASSWORD>\")\nprint(\"Credential stored in keyring\")\n'\n```\n\n### 1Password CLI (if configured):\n\n```bash\n# Sign in (requires setup)\neval $(op signin)\n\n# Get a credential\nop item get \"Telenor VDP\" --fields username,password --format=json\n```\n\n### Cookie injection from file:\n\n```python\n# Load cookies exported from browser (Netscape format or JSON)\ntimeout 30 python3 -u -c '\nimport json\nfrom curl_cffi import requests\n\n# Load cookies from JSON file (exported via browser extension)\nwith open(\"\u002Fworkspace\u002Fcookies.json\") as f:\n    cookie_data = json.load(f)\n\n# Build cookie jar\ncookies = {}\nfor c in cookie_data:\n    cookies[c[\"name\"]] = c[\"value\"]\n\nr = requests.get(\n    \"https:\u002F\u002F\u003CTARGET>\u002Fdashboard\",\n    impersonate=\"chrome131\",\n    cookies=cookies,\n    timeout=10,\n)\nprint(f\"Status: {r.status_code}\")\nprint(r.text[:500])\n'\n```\n\n## 5. CAPTCHA Handling\n\n### Cloudflare Turnstile — Scrapling handles this automatically:\n```python\n# StealthyFetcher automatically solves Turnstile challenges\npage = StealthyFetcher.fetch(\"https:\u002F\u002F\u003CTARGET>\", headless=True, network_idle=True)\n# If Turnstile was present, page.status will be 200 (solved) or 403 (failed)\n```\n\n### For other CAPTCHAs (reCAPTCHA, hCaptcha):\n1. **Manual solve**: Use Scrapling's StealthyFetcher to render the page, screenshot, solve manually\n2. **Token injection**: If you have a CAPTCHA-solving service API key, inject the token:\n\n```python\ntimeout 60 python3 -u -c '\nfrom curl_cffi import requests\n\n# After obtaining CAPTCHA token from a solving service:\nCAPTCHA_TOKEN = \"\u003Csolved-token>\"\n\nr = requests.post(\n    \"https:\u002F\u002F\u003CTARGET>\u002Flogin\",\n    impersonate=\"chrome131\",\n    data={\n        \"username\": \"test\",\n        \"password\": \"test\",\n        \"g-recaptcha-response\": CAPTCHA_TOKEN,\n    },\n    timeout=10,\n)\nprint(r.status_code, r.headers.get(\"location\", \"\"))\n'\n```\n\n## 6. Rate Limiting & Traffic Shaping\n\n```python\n# Respectful rate-limited scraping\ntimeout 120 python3 -u -c '\nimport time, random\nfrom curl_cffi import requests\nfrom fake_useragent import UserAgent\n\nua = UserAgent()\nTARGET = \"https:\u002F\u002F\u003CTARGET>\"\nPATHS = [\"\u002Fapi\u002Fusers\", \"\u002Fapi\u002Forders\", \"\u002Fapi\u002Fsettings\"]\n\nfor path in PATHS:\n    # Random delay: 2-5 seconds (mimics human)\n    time.sleep(random.uniform(2, 5))\n\n    r = requests.get(\n        f\"{TARGET}{path}\",\n        impersonate=\"chrome131\",\n        headers={\"User-Agent\": ua.random},\n        timeout=10,\n    )\n    print(f\"{r.status_code} {path}: {len(r.text)} bytes\")\n'\n```\n\n## Anti-Patterns (Do NOT)\n\n- **Never** send requests at machine speed without delays — even 100ms intervals look like a scanner\n- **Never** use default `python-requests` User-Agent for stealth operations — it's fingerprinted by every WAF\n- **Never** hardcode credentials in scripts — use keyring or env vars\n- **Never** skip the WAF detection step — knowing what you face determines the right bypass\n- **Never** use raw `requests.get()` against Cloudflare — it will always fail; use curl_cffi or scrapling\n- **Never** brute-force CAPTCHAs — solve or bypass them; repeated failures trigger IP bans\n\n## Decision Tree\n\n```\nTarget has anti-bot? → Yes → Which type?\n  ├─ Cloudflare Turnstile → StealthyFetcher (automatic)\n  ├─ Cloudflare JS Challenge → cloudscraper or StealthyFetcher\n  ├─ Akamai\u002FDataDome → StealthyFetcher with proxy rotation\n  ├─ reCAPTCHA\u002FhCaptcha → Manual solve or token injection\n  └─ Custom WAF → curl_cffi with browser TLS fingerprint\n\nTarget has rate limiting? → Yes\n  ├─ Soft (429 after N requests) → Add 2-5s random delays\n  └─ Hard (IP ban) → Rotate proxies via proxychains4 or Proxifly\n\nOPSEC level quiet\u002Fsilent?\n  ├─ Use Tor for DNS + requests (proxychains4)\n  ├─ Rotate User-Agents (fake-useragent)\n  └─ Never reuse the same proxy for >10 requests\n```\n","# Stealth Infrastructure — Anti-Bot Evasion & Covert Operations\n\nThis skill covers the stealth tooling installed in the sandbox for evading anti-bot systems, rotating proxies, solving CAPTCHAs, and retrieving credentials from password managers. Use these tools when the engagement RoE specifies OPSEC level `quiet` or `silent`, or when targets deploy WAFs\u002Fanti-bot shields.\n\n## Available Libraries (Pre-Installed)\n\n| Library | Purpose | When to use |\n|---------|---------|-------------|\n| **scrapling** | Adaptive scraping with Cloudflare Turnstile bypass, StealthyFetcher | Primary choice for any anti-bot-protected target |\n| **curl_cffi** | libcurl with impersonated TLS fingerprints (Chrome\u002FFirefox\u002FSafari) | When you need raw HTTP with real browser TLS |\n| **tls_client** | Go-based TLS fingerprint impersonation via Python | Alternative to curl_cffi for different fingerprint profiles |\n| **cloudscraper** | Cloudflare v1\u002Fv2 challenge solver | Legacy Cloudflare JS challenges |\n| **fake-useragent** | Realistic, rotating User-Agent strings | Any HTTP request needing normal-looking UA |\n| **proxychains4** | Force any CLI tool through a SOCKS\u002FHTTP proxy chain | Route nmap\u002Fcurl\u002Fsubfinder through Tor or proxy |\n| **tor** | Onion routing for IP anonymization | When source IP must not be linkable to operator |\n| **keyring** | OS keyring access (GNOME Keyring, macOS Keychain, Windows Credential Vault) | Retrieve stored credentials without hardcoding |\n| **python-socks** | SOCKS4\u002F5 proxy support for asyncio | Async HTTP through proxies |\n| **aiohttp-socks** | aiohttp + SOCKS proxy integration | Async scraping through proxy chains |\n\n## 1. Scrapling — Primary Anti-Bot Bypass\n\nScrapling's `StealthyFetcher` uses a real Chromium instance with anti-fingerprinting patches. It bypasses Cloudflare Turnstile, Akamai, DataDome, and most JS challenges.\n\n```python\n# Stealthy fetch — bypasses Cloudflare Turnstile and most anti-bot\ntimeout 60 python3 -u -c '\nfrom scrapling.fetchers import StealthyFetcher\n\npage = StealthyFetcher.fetch(\n    \"https:\u002F\u002F\u003CTARGET>\",\n    headless=True,\n    network_idle=True,\n    disable_resources=True,  # skip images\u002Ffonts for speed\n)\nprint(f\"Status: {page.status}\")\nprint(f\"Title: {page.css(\\\"title::text\\\").get()}\")\n# Extract data\nfor link in page.css(\"a[href]\"):\n    print(f\"  {link.attrib[\\\"href\\\"]}\")\n' 2>&1 | tee scrapling_result.txt\n```\n\n### With proxy rotation:\n```python\ntimeout 60 python3 -u -c '\nfrom scrapling.fetchers import StealthyFetcher\n\npage = StealthyFetcher.fetch(\n    \"https:\u002F\u002F\u003CTARGET>\",\n    headless=True,\n    network_idle=True,\n    proxy={\"server\": \"socks5:\u002F\u002F127.0.0.1:9050\"},  # Tor\n)\nprint(page.status, page.css(\"title::text\").get())\n'\n```\n\n### Session persistence (cookies survive across requests):\n```python\ntimeout 60 python3 -u -c '\nfrom scrapling.fetchers import StealthyFetcher\n\n# First request — login\nfetcher = StealthyFetcher()\npage = fetcher.fetch(\"https:\u002F\u002F\u003CTARGET>\u002Flogin\", headless=True)\n# Fill and submit login form...\n\n# Second request — authenticated, same session\npage2 = fetcher.fetch(\"https:\u002F\u002F\u003CTARGET>\u002Fdashboard\", headless=True)\nprint(page2.css(\"h1::text\").get())\n'\n```\n\n## 2. curl_cffi — TLS Fingerprint Impersonation\n\nReal browser TLS fingerprints without running a browser. Fastest option for API probing.\n\n```python\ntimeout 30 python3 -u -c '\nfrom curl_cffi import requests\n\n# Impersonate Chrome 131\nr = requests.get(\n    \"https:\u002F\u002F\u003CTARGET>\",\n    impersonate=\"chrome131\",\n    timeout=10,\n)\nprint(f\"Status: {r.status_code}\")\nprint(f\"Server: {r.headers.get(\\\"server\\\", \\\"?\\\")} | CF-RAY: {r.headers.get(\\\"cf-ray\\\", \\\"none\\\")}\")\nprint(r.text[:500])\n'\n```\n\n### With proxy:\n```python\nr = requests.get(\n    \"https:\u002F\u002F\u003CTARGET>\",\n    impersonate=\"chrome131\",\n    proxies={\"https\": \"socks5:\u002F\u002F127.0.0.1:9050\"},\n    timeout=10,\n)\n```\n\n### Available impersonation profiles:\n- `chrome99` through `chrome131`\n- `firefox109`, `firefox133`\n- `safari15_3`, `safari18_0`\n- `edge99`, `edge101`\n\n## 3. Proxy Infrastructure\n\n### Proxychains (route any CLI tool through proxy)\n\n```bash\n# Start Tor (if not running)\ntor &\nsleep 5\n\n# Route curl through Tor\nproxychains4 curl -s https:\u002F\u002Fcheck.torproject.org\u002Fapi\u002Fip\n\n# Route any scanner through Tor\nproxychains4 subfinder -d \u003CTARGET> -silent\nproxychains4 httpx-pd -l subdomains.txt -silent\n```\n\n### Free proxy rotation (Proxifly)\n\n```bash\n# Download fresh proxy list\ncurl -sL https:\u002F\u002Fcdn.jsdelivr.net\u002Fgh\u002Fproxifly\u002Ffree-proxy-list@main\u002Fproxies\u002Fprotocols\u002Fhttps\u002Fdata.json -o proxies.json\n\n# Use in Python\ntimeout 30 python3 -u -c '\nimport json, random\nfrom curl_cffi import requests\n\nwith open(\"proxies.json\") as f:\n    proxies = json.load(f)\n\n# Pick a random proxy\nproxy = random.choice(proxies)\nproxy_url = f\"{proxy[\\\"protocol\\\"]}:\u002F\u002F{proxy[\\\"ip\\\"]}:{proxy[\\\"port\\\"]}\"\nprint(f\"Using proxy: {proxy_url} ({proxy.get(\\\"country\\\", \\\"?\\\")})\")\n\nr = requests.get(\n    \"https:\u002F\u002F\u003CTARGET>\",\n    impersonate=\"chrome131\",\n    proxies={\"https\": proxy_url},\n    timeout=10,\n)\nprint(f\"Status: {r.status_code}\")\n'\n```\n\n### Custom proxy chain (edit \u002Fetc\u002Fproxychains4.conf)\n\n```bash\n# For OPSEC-quiet: chain through your VPN + Tor\ncat > \u002Ftmp\u002Fchain.conf \u003C\u003C 'EOF'\nstrict_chain\nproxy_dns\n[ProxyList]\nsocks5 \u003CYOUR_VPN_SOCKS_IP> \u003CPORT>\nsocks5 127.0.0.1 9050\nEOF\nproxychains4 -f \u002Ftmp\u002Fchain.conf curl -s https:\u002F\u002F\u003CTARGET>\n```\n\n## 4. Credential Retrieval from Password Managers\n\n### Python keyring (generic — works with GNOME Keyring, macOS Keychain, KWallet)\n\n```python\ntimeout 10 python3 -u -c '\nimport keyring\n\n# Retrieve stored credential\npassword = keyring.get_password(\"telenor-vdp\", \"test-user\")\nif password:\n    print(f\"Retrieved password for test-user: {password[:3]}***\")\nelse:\n    print(\"No credential stored. Use: keyring.set_password(\\\"telenor-vdp\\\", \\\"test-user\\\", \\\"\u003Cpassword>\\\")\")\n'\n```\n\n### Store credentials for the engagement:\n\n```python\ntimeout 10 python3 -u -c '\nimport keyring\nkeyring.set_password(\"telenor-vdp\", \"test-user\", \"\u003CPASSWORD>\")\nprint(\"Credential stored in keyring\")\n'\n```\n\n### 1Password CLI (if configured):\n\n```bash\n# Sign in (requires setup)\neval $(op signin)\n\n# Get a credential\nop item get \"Telenor VDP\" --fields username,password --format=json\n```\n\n### Cookie injection from file:\n\n```python\n# Load cookies exported from browser (Netscape format or JSON)\ntimeout 30 python3 -u -c '\nimport json\nfrom curl_cffi import requests\n\n# Load cookies from JSON file (exported via browser extension)\nwith open(\"\u002Fworkspace\u002Fcookies.json\") as f:\n    cookie_data = json.load(f)\n\n# Build cookie jar\ncookies = {}\nfor c in cookie_data:\n    cookies[c[\"name\"]] = c[\"value\"]\n\nr = requests.get(\n    \"https:\u002F\u002F\u003CTARGET>\u002Fdashboard\",\n    impersonate=\"chrome131\",\n    cookies=cookies,\n    timeout=10,\n)\nprint(f\"Status: {r.status_code}\")\nprint(r.text[:500])\n'\n```\n\n## 5. CAPTCHA Handling\n\n### Cloudflare Turnstile — Scrapling handles this automatically:\n```python\n# StealthyFetcher automatically solves Turnstile challenges\npage = StealthyFetcher.fetch(\"https:\u002F\u002F\u003CTARGET>\", headless=True, network_idle=True)\n# If Turnstile was present, page.status will be 200 (solved) or 403 (failed)\n```\n\n### For other CAPTCHAs (reCAPTCHA, hCaptcha):\n1. **Manual solve**: Use Scrapling's StealthyFetcher to render the page, screenshot, solve manually\n2. **Token injection**: If you have a CAPTCHA-solving service API key, inject the token:\n\n```python\ntimeout 60 python3 -u -c '\nfrom curl_cffi import requests\n\n# After obtaining CAPTCHA token from a solving service:\nCAPTCHA_TOKEN = \"\u003Csolved-token>\"\n\nr = requests.post(\n    \"https:\u002F\u002F\u003CTARGET>\u002Flogin\",\n    impersonate=\"chrome131\",\n    data={\n        \"username\": \"test\",\n        \"password\": \"test\",\n        \"g-recaptcha-response\": CAPTCHA_TOKEN,\n    },\n    timeout=10,\n)\nprint(r.status_code, r.headers.get(\"location\", \"\"))\n'\n```\n\n## 6. Rate Limiting & Traffic Shaping\n\n```python\n# Respectful rate-limited scraping\ntimeout 120 python3 -u -c '\nimport time, random\nfrom curl_cffi import requests\nfrom fake_useragent import UserAgent\n\nua = UserAgent()\nTARGET = \"https:\u002F\u002F\u003CTARGET>\"\nPATHS = [\"\u002Fapi\u002Fusers\", \"\u002Fapi\u002Forders\", \"\u002Fapi\u002Fsettings\"]\n\nfor path in PATHS:\n    # Random delay: 2-5 seconds (mimics human)\n    time.sleep(random.uniform(2, 5))\n\n    r = requests.get(\n        f\"{TARGET}{path}\",\n        impersonate=\"chrome131\",\n        headers={\"User-Agent\": ua.random},\n        timeout=10,\n    )\n    print(f\"{r.status_code} {path}: {len(r.text)} bytes\")\n'\n```\n\n## Anti-Patterns (Do NOT)\n\n- **Never** send requests at machine speed without delays — even 100ms intervals look like a scanner\n- **Never** use default `python-requests` User-Agent for stealth operations — it's fingerprinted by every WAF\n- **Never** hardcode credentials in scripts — use keyring or env vars\n- **Never** skip the WAF detection step — knowing what you face determines the right bypass\n- **Never** use raw `requests.get()` against Cloudflare — it will always fail; use curl_cffi or scrapling\n- **Never** brute-force CAPTCHAs — solve or bypass them; repeated failures trigger IP bans\n\n## Decision Tree\n\n```\nTarget has anti-bot? → Yes → Which type?\n  ├─ Cloudflare Turnstile → StealthyFetcher (automatic)\n  ├─ Cloudflare JS Challenge → cloudscraper or StealthyFetcher\n  ├─ Akamai\u002FDataDome → StealthyFetcher with proxy rotation\n  ├─ reCAPTCHA\u002FhCaptcha → Manual solve or token injection\n  └─ Custom WAF → curl_cffi with browser TLS fingerprint\n\nTarget has rate limiting? → Yes\n  ├─ Soft (429 after N requests) → Add 2-5s random delays\n  └─ Hard (IP ban) → Rotate proxies via proxychains4 or Proxifly\n\nOPSEC level quiet\u002Fsilent?\n  ├─ Use Tor for DNS + requests (proxychains4)\n  ├─ Rotate User-Agents (fake-useragent)\n  └─ Never reuse the same proxy for >10 requests\n```\n",{"name":5,"metadata":24,"description":7,"allowed-tools":29},{"tags":25,"subdomain":26,"when_to_use":27,"mitre_attack":28},"stealth, proxy, captcha, anti-bot, opsec, cookies, keyring","opsec","stealth, anti-bot, captcha, Cloudflare bypass, WAF evasion, proxy rotation, cookie injection, password manager, keyring, 1Password, GNOME Keyring, OPSEC quiet, anti-detection, TLS fingerprint, browser impersonation","T1562, T1036, T1090","Bash Read","master","8e5d356b795eae2edd4a26509a4b8968e2c4c251","packages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fshared\u002Fstealth-infra","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix","https:\u002F\u002Fgithub.com\u002FAkapi895","2026-11-06 17:46:09",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add Akapi895\u002Fraptix --skill stealth-infra",{"tool":42,"command":43},"bunx","bunx skills add Akapi895\u002Fraptix --skill stealth-infra",{"tool":45,"command":46},"pnpm","pnpm dlx skills add Akapi895\u002Fraptix --skill stealth-infra","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fshared\u002Fstealth-infra\u002FSKILL.md",true,[],[51,58,65,72,79,86],{"skillNo":52,"name":53,"nameZh":6,"description":54,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":55,"categories":56,"keywords":57,"publishedAt":19},"01M7DGM32SRP4FZSPYWY621BKQ","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":19},"01M7DGKXXVDTY0KBZZR83VFPZX","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":19},"01M7DGKSV77ENX3D6TG2HQX9MK","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":19},"01M7DGKJ9R6YTFRFBSEAJRGGKF","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":19},"01M7DGKCFZGKK2EQMWZM1A18S8","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M7DGK76MKZQWBXTZN82W7214","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]