reese84 Bypass Solution

The reese84 cookie is the core of an Incapsula bypass on ticketing sites. Load the challenge script, send it to Takion, and post the payload we return to retrieve a valid reese84 cookie.

How the solution works

To bypass Incapsula's (Imperva's) protection, follow these steps:

1. Load the script content.

2. Generate the challenge payload (using our API).

3. Post the payload to retrieve the Incapsula cookie.

How to identify the script URL

After visiting the target website, open your browser inspector tools and click on the network tab. The browser should have sent a request to a URL like https://whatever.com/anoy-route?d=www.yourtargetwebsite.com.

This is the script tag. All the responses should have returned a JSON body with token as one of the keys.

Endpoint

The endpoint lives on the Castle subdomain:

https://incapsula.takionapi.tech/reese84

Generate the reese84 payload

post

Send the reese84 challenge script (fetched from the target's ?d=<domain> route) and get back the challenge payload. Post that payload to the site's reese84 endpoint; the response carries the token to set as the reese84 cookie.

Authorizations

x-api-keystringRequired

Body

scriptstringRequired

The response text of the reese84 challenge script fetched from the target site (the ?d=<domain> route whose JSON body contains token).

Other propertiesanyOptional

Responses

200

The challenge payload. On a bad request an error field is returned instead — check for error before reading payload.

application/json

or

401

Authentication or quota failure — HTTP 401 with an error message.

application/json

500

Unexpected server error (HTTP 500).

application/json

post/reese84

POST /reese84 HTTP/1.1
Host: incapsula.takionapi.tech
x-api-key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 54

{
  "script": "text",
  "ANY_ADDITIONAL_PROPERTY": "anything"
}

{
  "payload": "text",
  "ANY_ADDITIONAL_PROPERTY": "anything"
}