Cloudflare ошибка 503

asked Mar 11, 2015 at 23:05

The issue seems to be that TeamSpeak is using CloudFlare’s DDoS protection in place. See the screenshot at the bottom of the answer. More details on what this protection is/means on this official Amazon page on CloudFlare’s security features:

CloudFlare leverages the knowledge of a diverse community of websites
to power a new type of security service. Online threats range from
nuisances like comment spam and excessive bot crawling to malicious
attacks like SQL injection and denial of service (DOS) attacks.
CloudFlare provides security protection against all of these types of
threats and more to keep your website safe.

More specifics on their advanced DDoS protection methods can be found here:

CloudFlare’s advanced DDoS protection, provisioned as a service at the
network edge, matches the sophistication and scale of such threats,
and can be used to mitigate DDoS attacks of all forms and sizes
including those that target the UDP and ICMP protocols, as well as
SYN/ACK, DNS amplification and Layer 7 attacks. This document explains
the anatomy of each attack method and how the CloudFlare network is
designed to protect your web presence from such threats.

Now how does this factor into the “503 Service Temporarily Unavailable” you are seeing? Well, that means that the site you are trying to access is under such a high level of protection from the Amazon CloudFlare DDoS detection/mitigation services that non-standard access via a command line tool like wget or curl is just not possible at this point.

FWIW, I have done a few different curl attempts from the command line and I believe what happens is that CloudFlare’s DDoS protection just acts like a huge web page proxy for sites that opt to use it. And the “real” website exists somewhere other than the IP address the hostname resolves to. Sites like this claim to give you the “real” IP address connected to a CloudFlare hostname, but it doesn’t seem to work at all. Or maybe the IP address that is given is valid, but the way the service is setup just denies you direct access to the real site without jumping through CloudFlare’s loops.

Which simply means, the best you can do is sit and wait and maybe in a few hours or possibly days the security issues that site faced will fade away and standard wget or curl calls can be made. But the reality is if this security protection is in place, and is solid, and the website owner does not disable it, then you can’t do much to get around it.

answered Mar 12, 2015 at 0:42

Just to follow up on this answer https://superuser.com/a/946274/755660 — now that __cfduid cookie is deprecated, this works:

wget --header='cookie: cf_chl_2=5f706f217dfec17; cf_chl_prog=x12; cf_clearance=6on.0F8CTI4m4K2dqEx63zQQD62bq63eF8OOITzovsI-1655756823-0-150' 
  --header='user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' 
  -np -r https://example.com/uploads

This will get all the sub-directories with -np (no-parent) and -r (recursive).

In order to get these values, open up your browser debugger and copy the network as curl and format it to wget. Only the user agent header and cookie headers are needed.

Here was what it looked like as cURL (replaced with example.com website) before I modified to wget.

curl 'https://example.com/uploads/' 
  --header='authority: example.com' 
  --header='accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' 
  --header='accept-language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7' 
  --header='cache-control: max-age=0' 
  --header='cookie: cf_chl_2=5f706f217dfec17; cf_chl_prog=x12; cf_clearance=6on.0F8CTI4m4K2dqEx63zQQD62bq63eF8OOITzovsI-1655756823-0-150' 
  --header='referer: https://example.com/wp-content/uploads/' 
  --header='sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="102", "Google Chrome";v="102"' 
  --header='sec-ch-ua-mobile: ?0' 
  --header='sec-ch-ua-platform: "macOS"' 
  --header='sec-fetch-dest: document' 
  --header='sec-fetch-mode: navigate' 
  --header='sec-fetch-site: same-origin' 
  --header='sec-fetch-user: ?1' 
  --header='upgrade-insecure-requests: 1' 
  --header='user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' 

answered Jun 20, 2022 at 21:00

This may be easier to use.

@echo off
set U=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0) Gecko/20100101 Firefox/9.0
set cf_clearance=
set SaveTo=
set Optional=-q
:If it fails, replace -q with -d -oLog for details.
for %%f in (
http://itorrents.org/torrent/606029c69df51ab29d5275b8ad4d531fa56a450b.torrent
) do wget %%f %Optional% -U "%U%" --header="Accept:text/html" --header="Cookie:__cfduid=dbef4c7a393e2d6a95385ccfadbc46e371591967392;cf_clearance=%cf_clearance%" -np -nd -P%SaveTo%
pause

According to this, cf_clearance may be valid for up to 1h45. This appears to be a solution for automating retrieval of these tokens. It uses Node.js that doesn’t run on XP. Couldn’t try it.

answered Jun 17, 2020 at 22:17