"kiwiflare" is just a variation of challenge.js
you download an image, hash it, return the hash and it does server side secret generation with the result. it takes about 800,000 - 1,500,000 attempts on your browsers end.
it was probably possible to pull cloudflare's original js challenge, download , inspect , and steal it the same way you can on kiwifarms' version right now.
cloudflare has since then moved to something called turnstile (challenges.cloudflare.com) and uses something more complicated and harder to rip off or inspect/disassemble now. but the thing they were using a couple of years ago would have been easy to steal and implement.
because of that, i cant compare them side by side and say whether it is in fact a copy of cloudflare's original challenge.js method
his method is not in fact an anti ddos, nor does it prevent scraping. once you have the SSSG token and xf_csrf you can scrape it or flood the server with as many automated requests as you want. You only need to use a real browser once, turn on development tools, click literally any link, "get curl command" and then insert your values for
sssg_clearance=
xf_csrf=
curl '
https://kiwifarms.st/threads/2025-12-01-roy-philipose-copyright-claims-board.234253/post-23133047' \
-H 'User-Agent: ShitZilla/5.0 (X11; LinSux x86_64; rv:666.0) Gecko/20100666 Firefox/666.0' \
-H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
-H 'Accept-Language: en-US,en;q=0.5' \
-H 'Accept-Encoding: gzip, deflate, br, zstd' \
-H 'DNT: 1' \
-H 'Sec-GPC: 1' \
-H 'Upgrade-Insecure-Requests: 1' \
-H 'Sec-Fetch-Dest: document' \
-H 'Sec-Fetch-Mode: navigate' \
-H 'Sec-Fetch-Site: same-origin' \
-H 'Sec-Fetch-User: ?1' \
-H 'Connection: keep-alive' \
-H 'Cookie: sssg_clearance=XXXXXaXX-XXXX-XXXX-XXX-XXXX; xf_csrf=ZazazaZAza'
thats why cloudflare uses turnstile now.
View attachment 104194
