logo
bars

Amazon AWS WAF
and CapMonster Cloud

Captcha solution, site integration, and testing.
Inherited a site with a captcha or another protection layer but no access to the source code? In that case you naturally ask: which solution is installed, is it configured correctly, and how can the workflow be tested?

In this article, we have tried to answer all the key questions. The first step in solving the task is to determine which protection system is being used. To do this, you can refer to the list of popular captchas and anti-bot protection systems, where you will find visual examples and key indicators that help you quickly understand what you are dealing with.

If you discover that your site uses Amazon AWS WAF, the next step is to study its properties and operation in more detail. In this article, you can also review the instructions on how to integrate Amazon AWS WAF so that you fully understand how it functions on your site. This will help you not only understand the current protection, but also properly plan its maintenance.

What is AWS WAF by Amazon
What is AWS WAF by Amazon

AWS WAF (Amazon Web Services Web Application Firewall) is a cloud-based web firewall from Amazon that protects sites, APIs, and web applications from attacks and malicious traffic. Simply put, it is a filter that sits in front of your site or API and decides which visitor traffic to allow and which to block.

If Challenge/CAPTCHA is enabled on the site, the visitor may see a separate verification page. They will be asked to complete a task, such as selecting all images from a category, to confirm they are not a bot.

How to solve AWS WAF via CapMonster Cloud

When testing resources protected by AWS WAF, it is important to ensure that the protection works correctly and is integrated properly.

You can manually verify the protection:

  • Open the page with the form or resource and ensure AWS WAF responds correctly to requests.
  • Try performing actions that might be restricted by WAF (e.g., massive requests, suspicious headers) — the server should block such requests or return an error.

After successfully passing the check, AWS WAF sets cookies that confirm the user or client has passed verification and trusted traffic is allowed.

For automatic captcha recognition, you can use specialized services, for example, CapMonster Cloud — a tool that accepts captcha parameters, processes them on its servers, and returns ready-made cookies or a token. These can be substituted into the browser to pass the check without user participation.

Working with CapMonster Cloud via API typically involves the following steps:

Creating a taskCreating a task
arrow
Sending an API requestSending an API request
arrow
Receiving the resultReceiving the result
arrow
Substituting aws-waf-token cookies on the pageSubstituting aws-waf-token cookies on the page
arrow
Amazon AWS WAF recognition using ready-made libraries
CapMonster Cloud provides ready-made libraries for convenient work in Python, JavaScript (Node.js), and C#.

Important: these code examples use cookieSolution=False. If you need to obtain cookies as a result, set cookieSolution=True.

Python
JavaScript
C#
Solution, obtaining parameters, and setting cookies
Example in Node.js for the full cycle of captcha recognition on your web page. Possible approaches: use HTTP requests to get HTML and protection system parameters, send the answer, and process the result. Or using automation tools (e.g., Playwright) — open the page, wait for the check, send parameters via the CapMonster Cloud client, get the result, substitute cookies into the browser (for testing you can use both correct and incorrect data), and see the result.
// npm install playwright @zennolab_com/capmonstercloud-client
// npx playwright install chromium

import { chromium } from "playwright";
import { CapMonsterCloudClientFactory, ClientOptions, AmazonRequest } from "@zennolab_com/capmonstercloud-client";

const API_KEY = "YOUR_API_KEY";
const CAPTCHA_URL = "https://example.com";

// Proxy settings
const PROXY = {
    proxyType: "http",
    proxyAddress: "PROXY_HOST",
    proxyPort: 1234,
    proxyLogin: "PROXY_USER",
    proxyPassword: "PROXY_PASS"
};

(async () => {
    // 1) Open the page via proxy and collect AWS WAF parameters
    const browser = await chromium.launch({
        headless: false,
        proxy: {
            server: `http://${PROXY.proxyAddress}:${PROXY.proxyPort}`,
            username: PROXY.proxyLogin,
            password: PROXY.proxyPassword
        }
    });

    const page = await browser.newPage();
    await page.goto(CAPTCHA_URL, { waitUntil: "networkidle" });

    // wait for challenge and captcha scripts to load
    await page.waitForFunction(() => {
        const scripts = Array.from(document.querySelectorAll("script")).map(s => s.src || "");
        return scripts.some(src => src.includes("challenge")) && scripts.some(src => src.includes("captcha"));
    });

    // extract AWS WAF parameters (key, context, iv, links to scripts)
    const params = await page.evaluate(() => {
        const gokuProps = window.gokuProps || {};
        const scripts = Array.from(document.querySelectorAll("script")).map(s => s.src || "");
        return {
            websiteKey: gokuProps.key || null,
            context: gokuProps.context || null,
            iv: gokuProps.iv || null,
            challengeScript: scripts.find(src => src.includes("challenge")),
            captchaScript: scripts.find(src => src.includes("captcha"))
        };
    });

    await browser.close();

    // 2) Solve AWS WAF via CapMonster Cloud
    const client = CapMonsterCloudClientFactory.Create(new ClientOptions({ clientKey: API_KEY }));

    const req = new AmazonRequest({
        websiteURL: CAPTCHA_URL,
        websiteKey: params.websiteKey,
        challengeScript: params.challengeScript,
        captchaScript: params.captchaScript,
        context: params.context,
        iv: params.iv,
        cookieSolution: true,
        proxy: PROXY
    });

    const solved = await client.Solve(req);
    const wafToken = solved.solution.cookies["aws-waf-token"];

    // 3) Substitute aws-waf-token and clear old ones
    const browser2 = await chromium.launch({
        headless: false,
        proxy: {
            server: `http://${PROXY.proxyAddress}:${PROXY.proxyPort}`,
            username: PROXY.proxyLogin,
            password: PROXY.proxyPassword
        }
    });

    const context2 = await browser2.newContext();

    // cleaning old aws-waf-token for your domain
    const existingCookies = await context2.cookies();
    const filteredCookies = existingCookies.filter(c => !(c.name === "aws-waf-token" && c.domain.endsWith(".your-domain")));
    await context2.clearCookies();
    await context2.addCookies(filteredCookies);

    // setting new aws-waf-token
    await context2.addCookies([{
        name: "aws-waf-token",
        value: wafToken,
        domain: ".your-domain",
        path: "/",
        httpOnly: false,
        secure: true
    }]);

    const page2 = await context2.newPage();
    const response = await page2.goto(CAPTCHA_URL, { waitUntil: "networkidle" });

    console.log("Final page status:", response.status());
    console.log("Final page URL:", page2.url());

    await browser2.close();
})();
How to connect AWS WAF to your site
To confidently navigate captcha operation on your site, understand its verification logic, reconnect or reconfigure it, we recommend studying this section. It describes the protection connection process — this will help you quickly figure out all the nuances.

AWS WAF cannot be installed directly on a site. It works only through AWS resources:

  • Amazon CloudFront (main and best option) — a CDN through which any site can be protected. Works fast, globally, and suits almost all cases.
  • Application Load Balancer (ALB) — used for server-side sites, APIs, and containers within AWS. If your backend runs in EC2, ECS, EKS — place WAF on ALB.
  • API Gateway — protection for REST and WebSocket APIs. Suitable for SPA, mobile apps, and microservices.
  • AWS AppSync (GraphQL API)
  • Amazon Cognito (login/registration)
  • AWS App Runner (container apps)
  • AWS Amplify Hosting (frontend hosting)
  • AWS Verified Access (access to internal apps)

Step 1. Create an AWS account (if you don't have one)

Go to: https://portal.aws.amazon.com/billing/signup. Create an account > confirm email and phone.

Step 2. You can use the standard or the new AWS WAF interface:

  1. Go to the AWS console
  2. Open AWS WAF. In the left menu, click Try the new experience (if prompted).

Step 3. Create a protection pack (web ACL)

This is the set of protection rules for your resource.

  1. In the menu on the left, select: Resources & protection packs (Web ACLs)
  2. Click Add protection pack (web ACL).

Step 4. Configure application category:

In the Tell us about your app block:

  • App category — select Web / API / Both
  • Traffic source — where the traffic comes from (web, API, or both)

These parameters are needed so AWS can suggest optimal rules.

Step 5. Select resources to protect

  1. Click Add resources
  2. Select what you are connecting:

If your site is on CloudFront > select CloudFront distributions
If your backend is on ALB > select Regional resources
If API > select API Gateway REST API
Check the box on the desired resource > click Add.

Step 6. Select a starting rule set.

AWS will offer:

Recommended for you — the best option for beginners

It includes:

  • basic protection
  • rules against SQLi and XSS
  • IP reputation lists
  • Bot Control (optional)
  • rules for web/API

Click Next.

Step 7. Configuration (optional)

On the Customize protection pack (web ACL) screen:

Main parameters:

  • Default action:
    • Allow all except blocked — usually selected
    • Block all except allowed — if the site is closed
  • Default rate limits: Limit on the number of requests (DDoS L7 mitigation)
  • IP addresses: Whitelists/blacklists
  • Country specific origins: Traffic restriction by country

Logging

Choose where to write logs:

  • CloudWatch
  • S3
  • Firehose

(S3 + Athena is recommended).

Step 8. Create web ACL

Click: Add protection pack (web ACL)

AWS will create rules and bind them to your resource.

Verification

To ensure protection is working:

  1. Open WAF > select your web ACL
  2. Go to Monitoring
  3. Look at:
    • traffic charts
    • blocked requests
    • sample requests

Additional (optional)

  • Enable CAPTCHA or Challenge

    In any rule > Action > CAPTCHA / Challenge

    This reduces bot traffic and protects login and form pages.

  • Add Managed Rule Groups

    In the Rule groups section, you can add:

    • AWS Managed
    • Bot Control
    • Account takeover prevention
    • Marketplace rules (F5, Imperva, Fortinet)
  • Link with Shield Advanced. For protection against DDoS (L3–L7).

Background
Possible errors and debugging
Bug Icon
Invalid domain or rule — Challenge not displayed
Check that the AWS WAF WebACL is attached to the correct domain (CloudFront Distribution / ALB / API Gateway), the correct path, and that there are no conflicts between rules.
Bug Icon
Page load or check timeout
Sometimes the browser or script does not wait for the AWS WAF response. Increase timeouts in tests and ensure the backend processes requests without delays.
Bug Icon
Expired AWS WAF cookies
Outdated _aws_waf_token_… or related cookie tags lead to a repeated Challenge or temporary block.
Bug Icon
Overly sensitive rules
Excessively strict Bot Control signatures, CAPTCHA rules, or Rate-based rules may block real users.
Bug Icon
Incorrect WebACL configuration
Errors in rule order, priorities, or conditions can lead to false positives and blocks.
Protection resilience checks
After integration, make sure the system really protects the site from automated actions.
Security and optimization tips
Configure WebACL according to the risk level. Use Managed Rules (AWS, AWS Marketplace), AWS Bot Control, and custom rules based on IP reputation, headers, rate limiting, and other conditions.
Log WAF events. Enable <a href="https://docs.aws.amazon.com/waf/latest/developerguide/logging.html" target="_blank">AWS WAF Logging (Kinesis Firehose / S3 / CloudWatch Logs)</a> to analyze false positives and optimize rules.
Add links to <b>Privacy Policy</b> and <b>Terms of Use</b>. This is important for transparency and compliance with security requirements and user expectations.
Conclusion

If you’ve taken over a website that already has a captcha or another protection system installed, but you don’t have access to the code, don’t worry! It’s quite easy to identify which technology is being used. To verify that everything works correctly, you can use the CapMonster Cloud recognition service in an isolated test environment to make sure that the token processing mechanism and the validation logic are functioning properly.

In the case of Amazon AWS WAF, it’s enough to detect the system, observe its behavior, and confirm that the protection is working correctly. In this article, we showed how to identify Amazon AWS WAF and where to find instructions on how to integrate or reconfigure it, so you can confidently maintain the protection and keep its operation under control.

Conclusion
Helpful links
DocIconAWS WAF DocumentationDocIconCapMonster Cloud Documentation (working with AWS WAF)DocIconOverview of web resource protection using AWS WAF