> For the complete documentation index, see [llms.txt](https://docs.disasm.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.disasm.dev/incapsula/reese84.md). # reese84 Sites protected by **Incapsula** (now Imperva) often require solving the `reese84` sensor challenge before granting access. This page explains how to detect the challenge and solve it with our API. For the request fundamentals that apply throughout, see [TLS & Fingerprinting](/getting-started/tls-fingerprinting.md). ## Do you need to solve reese84? If you are blocked by Incapsula, you typically receive a "Pardon Our Interruption" page: > **Pardon Our Interruption** Your request was blocked as part of a security challenge. This usually happens when the site thinks your behaviour may resemble that of a bot. A simplified version of the block page: ```html ``` ## Find the reese84 endpoint Inside the block page, look for a script tag injected by the site. It often looks like this: ```js if (!isSpa) { var scriptElement = document.createElement('script'); scriptElement.type = "text/javascript"; scriptElement.src = "/Exeunt-the-To-plucke-own-what-withathe-now-Busin/QY0pUGn0a7n3HCKOzYTo-83x_qJnyPzHCCgdxrW1H2g?d=join.pokemon.com"; scriptElement.async = true; scriptElement.defer = true; document.head.appendChild(scriptElement); } ``` In this example, taken from `https://join.pokemon.com`, the challenge endpoint is: ``` https://join.pokemon.com/Exeunt-the-To-plucke-own-what-withathe-now-Busin/QY0pUGn0a7n3HCKOzYTo-83x_qJnyPzHCCgdxrW1H2g?d=join.pokemon.com ``` ## Solve reese84 with our API Fetch the challenge script from that endpoint, base64-encode it, and `POST` it to our API along with the page URL, the Incapsula script URL and your user agent - see the [API Reference](https://github.com/toman-tom/disasm.dev-docs/tree/master/incapsula/api-reference.md). We return a solution; submit that solution to the Incapsula endpoint and you receive a `token` in response. That `token` is the reese84 cookie - add it to your cookie jar. ## Proof of work (PoW) Some Incapsula sites add a **proof-of-work** step: on top of the sensor payload, the client must solve a short computational challenge issued by the server. Our API solves it for you - you fetch the challenge from the site and forward it in the `pow` field. ### Is PoW enabled on the target? PoW is enabled per site. You can tell it is active when the challenge script makes a **`POST` to the reese84 endpoint with the body `{ "f": "gpc" }`** ("get PoW challenge"). If you see that request in the target's traffic, the site expects a solved PoW, and a normal reese84 payload on its own will be rejected. For example, captured from `join.pokemon.com`: ```http POST /Exeunt-the-To-plucke-own-what-withathe-now-Busin/QY0pUGn0a7n3HCKOzYTo-83x_qJnyPzHCCgdxrW1H2g?d=join.pokemon.com HTTP/2 authority: join.pokemon.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 accept: application/json; charset=utf-8 content-type: text/plain; charset=utf-8 sec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="150", "Google Chrome";v="150" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" origin: https://join.pokemon.com sec-fetch-site: same-origin sec-fetch-mode: cors sec-fetch-dest: empty referer: https://join.pokemon.com/ accept-language: en-GB,en-US;q=0.9,en;q=0.8 {"f":"gpc"} ``` Note the body is sent with `content-type: text/plain; charset=utf-8` (not `application/json`) - match that, along with the same browser headers, when you replicate the request. ### 1. Fetch the challenge Make that same request yourself: `POST` the body `{ "f": "gpc" }` to the reese84 endpoint - the same `incapsula_url` you fetched the challenge script from - reusing the same proxy, session and user agent as the rest of the flow. ```bash curl -X POST "https://join.pokemon.com/Exeunt-the-To-plucke-own-what-withathe-now-Busin/QY0pUGn0a7n3HCKOzYTo-83x_qJnyPzHCCgdxrW1H2g?d=join.pokemon.com" \ -H "content-type: text/plain; charset=utf-8" \ -H "accept: application/json; charset=utf-8" \ -H "user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" \ --data '{"f":"gpc"}' ``` The response body is the PoW challenge - a base64 string. Pass it through unchanged. ### 2. Send it to our API Add the challenge to the `pow` field of your normal reese84 request, alongside the usual `page_url`, `incapsula_url`, `user_agent` and `script_b64`: ```bash curl -X POST https://incap.antibotapi.com/reese84 \ -H "x-api-key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "page_url": "https://join.pokemon.com/", "incapsula_url": "https://join.pokemon.com/Exeunt-the-To-plucke-own-what-withathe-now-Busin/QY0pUGn0a7n3HCKOzYTo-83x_qJnyPzHCCgdxrW1H2g?d=join.pokemon.com", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36", "script_b64": "", "pow": "" }' ``` We solve the challenge, embed the result in the payload, and return the solution exactly as in the non-PoW flow. Submit it to the Incapsula endpoint to receive your `token`. {% hint style="info" %} **PoW is optional** \ The `pow` field is optional - if the site does not issue a `{ "f": "gpc" }` request, leave it out entirely. {% endhint %} {% hint style="info" %} **For best results when PoW is enabled**
For best results when PoW is enabled, wait a random delay of between 1-2 seconds before submitting ther solution to the Incapsula endpoint. {% endhint %} {% hint style="warning" %} Each challenge is tied to the session that requested it, so fetch a fresh one for every reese84 solve and keep the same proxy, session and user agent across the whole flow. {% endhint %}