In this article, we have tried to answer all the key questions. The first step in solving the task is to determine which protection system is being used. To do this, you can refer to the list of popular captchas and anti-bot protection systems, where you will find visual examples and key indicators that help you quickly understand what you are dealing with.
If you discover that your site uses Amazon AWS WAF, the next step is to study its properties and operation in more detail. In this article, you can also review the instructions on how to integrate Amazon AWS WAF so that you fully understand how it functions on your site. This will help you not only understand the current protection, but also properly plan its maintenance.
AWS WAF (Amazon Web Services Web Application Firewall) is a cloud-based web firewall from Amazon that protects sites, APIs, and web applications from attacks and malicious traffic. Simply put, it is a filter that sits in front of your site or API and decides which visitor traffic to allow and which to block.
If Challenge/CAPTCHA is enabled on the site, the visitor may see a separate verification page. They will be asked to complete a task, such as selecting all images from a category, to confirm they are not a bot.
When testing resources protected by AWS WAF, it is important to ensure that the protection works correctly and is integrated properly.
You can manually verify the protection:
After successfully passing the check, AWS WAF sets cookies that confirm the user or client has passed verification and trusted traffic is allowed.
For automatic captcha recognition, you can use specialized services, for example, CapMonster Cloud — a tool that accepts captcha parameters, processes them on its servers, and returns ready-made cookies or a token. These can be substituted into the browser to pass the check without user participation.
Working with CapMonster Cloud via API typically involves the following steps:
The following parameters must be specified in the request to solve AWS WAF:
type - AmazonTask;
websiteURL - address of the main page where the captcha is solved;
challengeScript - link to challenge.js;
The following parameters are taken from window.gokuProps (all are of string type):
captchaScript - link to captcha.js (may be absent if you only have a Challenge);
cookieSolution - default is false — in response you will receive "captcha_voucher" and "existing_token". If you require "aws-waf-token" cookies, set the value to true.;
userAgent - Browser User-Agent. Pass only actual UA from Windows OS;
Also, for this task, you need to use your proxies:
proxyType :
proxyAddress - Proxy IP address IPv4/IPv6;
proxyPort - proxy port;
proxyLogin - proxy server login;
proxyPassword - proxy server password.
https://api.capmonster.cloud/createTask{
"clientKey": "API_KEY",
"task": {
"type": "AmazonTask",
"websiteURL": "https://example.com/index.html",
"websiteKey": "h15hX7brbaRTR...Za1_1",
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36",
"captchaScript": "https://234324vgvc23.yejk.captcha-sdk.awswaf.com/234324vgvc23/jsapi.js",
"cookieSolution": true,
"proxyType": "http",
"proxyAddress": "8.8.8.8",
"proxyPort": 8080,
"proxyLogin": "proxyLoginHere",
"proxyPassword": "proxyPasswordHere"
}
}{
"errorId":0,
"taskId":407533072
}https://api.capmonster.cloud/getTaskResult{
"clientKey":"API_KEY",
"taskId": 407533072
}{
"errorId":0,
"status":"ready",
"solution": {
"cookies": {
"aws-waf-token": "10115f5b-ebd8-45c7-851e-cfd4f6a82e3e:EAoAua1QezAhAAAA:dp7sp2rXIRcnJcmpWOC1vIu+yq/A3EbR6b6K7c67P49usNF1f1bt/Af5pNcZ7TKZlW+jIZ7QfNs8zjjqiu8C9XQq50Pmv2DxUlyFtfPZkGwk0d27Ocznk18/IOOa49Rydx+/XkGA7xoGLNaUelzNX34PlyXjoOtL0rzYBxMAQy0D1tn+Q5u97kJBjs5Mytqu9tXPIPCTSn4dfXv5llSkv9pxBEnnhwz6HEdmdJMdfur+YRW1MgCX7i3L2Y0/CNL8kd8CEhTMzwyoXekrzBM="
},
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
}
}The data received from CapMonster Cloud (valid AWS WAF cookies) can be substituted into the browser context or HTTP client. After this, the site perceives the request as verified and allows you to continue working without additional checks or challenge pages.
For automation and testing, it is convenient to use Puppeteer, Selenium, or Playwright — they allow you to:
This way, you can verify the correctness of the protection and ensure the site correctly accepts and processes valid AWS WAF cookies.
Important: these code examples use cookieSolution=False. If you need to obtain cookies as a result, set cookieSolution=True.
// npm install playwright @zennolab_com/capmonstercloud-client
// npx playwright install chromium
import { chromium } from "playwright";
import { CapMonsterCloudClientFactory, ClientOptions, AmazonRequest } from "@zennolab_com/capmonstercloud-client";
const API_KEY = "YOUR_API_KEY";
const CAPTCHA_URL = "https://example.com";
// Proxy settings
const PROXY = {
proxyType: "http",
proxyAddress: "PROXY_HOST",
proxyPort: 1234,
proxyLogin: "PROXY_USER",
proxyPassword: "PROXY_PASS"
};
(async () => {
// 1) Open the page via proxy and collect AWS WAF parameters
const browser = await chromium.launch({
headless: false,
proxy: {
server: `http://${PROXY.proxyAddress}:${PROXY.proxyPort}`,
username: PROXY.proxyLogin,
password: PROXY.proxyPassword
}
});
const page = await browser.newPage();
await page.goto(CAPTCHA_URL, { waitUntil: "networkidle" });
// wait for challenge and captcha scripts to load
await page.waitForFunction(() => {
const scripts = Array.from(document.querySelectorAll("script")).map(s => s.src || "");
return scripts.some(src => src.includes("challenge")) && scripts.some(src => src.includes("captcha"));
});
// extract AWS WAF parameters (key, context, iv, links to scripts)
const params = await page.evaluate(() => {
const gokuProps = window.gokuProps || {};
const scripts = Array.from(document.querySelectorAll("script")).map(s => s.src || "");
return {
websiteKey: gokuProps.key || null,
context: gokuProps.context || null,
iv: gokuProps.iv || null,
challengeScript: scripts.find(src => src.includes("challenge")),
captchaScript: scripts.find(src => src.includes("captcha"))
};
});
await browser.close();
// 2) Solve AWS WAF via CapMonster Cloud
const client = CapMonsterCloudClientFactory.Create(new ClientOptions({ clientKey: API_KEY }));
const req = new AmazonRequest({
websiteURL: CAPTCHA_URL,
websiteKey: params.websiteKey,
challengeScript: params.challengeScript,
captchaScript: params.captchaScript,
context: params.context,
iv: params.iv,
cookieSolution: true,
proxy: PROXY
});
const solved = await client.Solve(req);
const wafToken = solved.solution.cookies["aws-waf-token"];
// 3) Substitute aws-waf-token and clear old ones
const browser2 = await chromium.launch({
headless: false,
proxy: {
server: `http://${PROXY.proxyAddress}:${PROXY.proxyPort}`,
username: PROXY.proxyLogin,
password: PROXY.proxyPassword
}
});
const context2 = await browser2.newContext();
// cleaning old aws-waf-token for your domain
const existingCookies = await context2.cookies();
const filteredCookies = existingCookies.filter(c => !(c.name === "aws-waf-token" && c.domain.endsWith(".your-domain")));
await context2.clearCookies();
await context2.addCookies(filteredCookies);
// setting new aws-waf-token
await context2.addCookies([{
name: "aws-waf-token",
value: wafToken,
domain: ".your-domain",
path: "/",
httpOnly: false,
secure: true
}]);
const page2 = await context2.newPage();
const response = await page2.goto(CAPTCHA_URL, { waitUntil: "networkidle" });
console.log("Final page status:", response.status());
console.log("Final page URL:", page2.url());
await browser2.close();
})();
AWS WAF cannot be installed directly on a site. It works only through AWS resources:
Step 1. Create an AWS account (if you don't have one)
Go to: https://portal.aws.amazon.com/billing/signup. Create an account > confirm email and phone.
Step 2. You can use the standard or the new AWS WAF interface:
Step 3. Create a protection pack (web ACL)
This is the set of protection rules for your resource.
Step 4. Configure application category:
In the Tell us about your app block:
These parameters are needed so AWS can suggest optimal rules.
Step 5. Select resources to protect
If your site is on CloudFront > select CloudFront distributions
If your backend is on ALB > select Regional resourcesIf API > select API Gateway REST APICheck the box on the desired resource > click Add.
Step 6. Select a starting rule set.
AWS will offer:
Recommended for you — the best option for beginners
It includes:Click Next.
Step 7. Configuration (optional)
On the Customize protection pack (web ACL) screen:
Main parameters:
Logging
Choose where to write logs:
(S3 + Athena is recommended).
Step 8. Create web ACL
Click: Add protection pack (web ACL)
AWS will create rules and bind them to your resource.
Verification
To ensure protection is working:
In any rule > Action > CAPTCHA / Challenge
This reduces bot traffic and protects login and form pages.
In the Rule groups section, you can add:
If you’ve taken over a website that already has a captcha or another protection system installed, but you don’t have access to the code, don’t worry! It’s quite easy to identify which technology is being used. To verify that everything works correctly, you can use the CapMonster Cloud recognition service in an isolated test environment to make sure that the token processing mechanism and the validation logic are functioning properly.
In the case of Amazon AWS WAF, it’s enough to detect the system, observe its behavior, and confirm that the protection is working correctly. In this article, we showed how to identify Amazon AWS WAF and where to find instructions on how to integrate or reconfigure it, so you can confidently maintain the protection and keep its operation under control.