Elliot has updated his kiwifarms tool.
Github.com/endharassment/tor-fetcher/commit/929266e4156961b923c77837715659223b3f2122
He even included this in the comments urlscan.io/api/v1/result/019c307d-9f9d-72ac-a600-a6319d5708d7/
Might be worth keeping a small eye on it considering it might give someone else the ability to abuse.
What it likely does NOT handle well:
Multi-stage challenges - No evidence of handling multiple sequential puzzles
Session/cookie management - Appears to be a simple fetch tool, not a full browser session manager
Captcha solving - haproxy-protection can require BOTH PoW AND captcha (hCaptcha/reCAPTCHA). The tool only handles PoW.
JavaScript fingerprinting - Sites could detect it's not a real browser
Adaptive difficulty - No indication it handles servers that ramp up difficulty for repeated requests
Timing attack prevention - Sites might detect it solves puzzles "too efficiently"
Tor circuit manipulation - haproxy-protection can communicate with Tor's control port to close circuits; no evidence this tool handles that.
Anti-automation measures:
Timing checks: Sites could detect if puzzles are being solved "too quickly" (faster than JavaScript typically would) and block those attempts as bot behavior.
Browser fingerprinting: Even with the User-Agent spoofing, sites might check for other browser characteristics (JavaScript execution environment, WebGL capabilities, etc.) that this command-line tool can't replicate.
Session/cookie requirements: Sites might require maintaining session state, handling multiple redirects, or storing cookies in specific ways that a simple fetch tool might not handle.
Adaptive difficulty: Sites could implement systems that increase difficulty for IPs/circuits that make repeated requests, specifically to thwart automated scraping.
Browser fingerprinting
Even with User-Agent spoofing, Tartarus could check for:
JavaScript execution environment
WebGL capabilities
Canvas fingerprinting
HTTP header patterns that don't match real browsers
TLS fingerprinting
tor-fetcher is a command-line HTTP client - it lacks the full browser fingerprint.
Session/cookie complexity
Tartarus could require:
Multiple redirects with state
Complex cookie handling
Proof that you executed JavaScript
Time-based tokens that expire quickly.
At the end of the day it's upto null to decide how he wants his tool to work but making erriot angy is funny.
