Spaces:

reikernx
/

if

Runtime error

if / server.js

Update server.js

289c1a7 verified 12 months ago

9.67 kB

import express from "express";
import axios from "axios";
import cors from "cors";

const app = express();

// Enable CORS for all routes
app.use(cors());

// Parse JSON bodies
app.use(express.json());

// Health check
app.get("/", (req, res) => res.send("🔥 Advanced Proxy Server Live"));

// Main proxy endpoint with aggressive spoofing
app.get("/proxy", async (req, res) => {
  const { url, matchId, home, away, referer } = req.query;
  
  if (!url) return res.status(400).send("❌ Missing ?url param");

  const targetUrl = decodeURIComponent(url);
  
  // Dynamic referer generation
  const customReferer = referer || 
    (matchId && home && away 
      ? `https://www.808ball6.com/football/${matchId}-${home}-vs-${away}.html` 
      : "https://www.808ball6.com/");

  // Extract domain from target URL for origin spoofing
  const urlObj = new URL(targetUrl);
  const targetOrigin = `${urlObj.protocol}//${urlObj.hostname}`;

  try {
    const response = await axios.get(targetUrl, {
      headers: {
        // Browser identification
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
        
        // Accept headers
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
        "Accept-Language": "en-US,en;q=0.9,es;q=0.8,fr;q=0.7",
        "Accept-Encoding": "gzip, deflate, br, zstd",
        
        // Referer and Origin
        "Referer": customReferer,
        "Origin": targetOrigin,
        
        // Connection
        "Connection": "keep-alive",
        
        // Security/Fetch metadata
        "Sec-Fetch-Dest": "iframe",
        "Sec-Fetch-Mode": "navigate",
        "Sec-Fetch-Site": "cross-site",
        "Sec-Fetch-User": "?1",
        
        // Chrome-specific headers
        "Sec-Ch-Ua": '"Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"',
        "Sec-Ch-Ua-Mobile": "?0",
        "Sec-Ch-Ua-Platform": '"Windows"',
        "Sec-Ch-Ua-Arch": '"x86"',
        "Sec-Ch-Ua-Bitness": '"64"',
        "Sec-Ch-Ua-Full-Version-List": '"Google Chrome";v="131.0.6778.86", "Chromium";v="131.0.6778.86", "Not_A Brand";v="24.0.0.0"',
        
        // Additional realistic headers
        "Upgrade-Insecure-Requests": "1",
        "DNT": "1",
        "Cache-Control": "max-age=0",
        "Priority": "u=0, i",
        
        // Cookie forwarding (if provided)
        ...(req.headers.cookie && { "Cookie": req.headers.cookie }),
        
        // Cloudflare bypass headers
        "CF-Connecting-IP": "8.8.8.8",
        "X-Forwarded-For": "8.8.8.8",
        "X-Real-IP": "8.8.8.8",
        "X-Forwarded-Host": urlObj.hostname,
        "X-Forwarded-Proto": "https",
        
        // Additional anti-detection
        "Device-Memory": "8",
        "Viewport-Width": "1920",
        "DPR": "1"
      },
      responseType: "arraybuffer",
      maxRedirects: 10,
      validateStatus: () => true,
      timeout: 30000,
      decompress: true,
      
      // Proxy configuration (if needed)
      // proxy: false, // Disable if you don't have a proxy
      
      // HTTP/2 support
      httpAgent: false,
      httpsAgent: false
    });

    // Set response headers
    const contentType = response.headers["content-type"] || "text/html; charset=utf-8";
    
    // Remove anti-iframe headers
    const headersToRemove = [
      "x-frame-options",
      "content-security-policy",
      "content-security-policy-report-only",
      "x-content-security-policy",
      "x-webkit-csp",
      "strict-transport-security"
    ];
    
    // Copy safe headers
    Object.keys(response.headers).forEach(key => {
      if (!headersToRemove.includes(key.toLowerCase())) {
        res.setHeader(key, response.headers[key]);
      }
    });
    
    res.setHeader("Content-Type", contentType);
    res.setHeader("Access-Control-Allow-Origin", "*");
    res.setHeader("Access-Control-Allow-Methods", "*");
    res.setHeader("Access-Control-Allow-Headers", "*");
    res.setHeader("X-Frame-Options", "ALLOWALL");
    res.setHeader("X-Content-Type-Options", "nosniff");

    // Handle HTML responses with frame-busting prevention
    if (contentType.includes("text/html")) {
      let html = response.data.toString("utf-8");
      
      // Aggressive frame-busting prevention
      const antiFrameBust = `
        <script>
          (function() {
            // Freeze top and parent
            try {
              Object.defineProperty(window, 'top', { 
                get: function() { return window.self; },
                set: function() {},
                configurable: false
              });
              Object.defineProperty(window, 'parent', { 
                get: function() { return window.self; },
                set: function() {},
                configurable: false
              });
              Object.defineProperty(window, 'frameElement', {
                get: function() { return null; },
                set: function() {},
                configurable: false
              });
              
              // Override location checks
              var originalLocation = window.location;
              Object.defineProperty(window, 'location', {
                get: function() { return originalLocation; },
                set: function(val) {
                  if (window.self === window.top) {
                    originalLocation = val;
                  }
                }
              });
              
              // Disable common frame-busting patterns
              window.onbeforeunload = null;
              
              // Intercept and block certain navigation attempts
              var _confirm = window.confirm;
              window.confirm = function() { return true; };
              
              var _alert = window.alert;
              window.alert = function() {};
              
            } catch(e) {
              console.log('Frame protection applied');
            }
          })();
        </script>
      `;
      
      // Inject at multiple points for maximum coverage
      html = html.replace(/<!DOCTYPE/i, antiFrameBust + '<!DOCTYPE');
      html = html.replace(/<head>/i, `<head>${antiFrameBust}`);
      html = html.replace(/<head\s/i, `<head>${antiFrameBust} `);
      
      // If no head tag, inject at start
      if (!/<head/i.test(html)) {
        html = antiFrameBust + html;
      }
      
      // Rewrite absolute URLs to go through proxy
      html = html.replace(
        /(src|href)=["'](https?:\/\/[^"']+)["']/gi,
        (match, attr, url) => {
          if (url.includes(urlObj.hostname)) {
            return `${attr}="/proxy?url=${encodeURIComponent(url)}"`;
          }
          return match;
        }
      );
      
      return res.send(html);
    }

    // For non-HTML content, send as-is
    res.send(response.data);

  } catch (err) {
    console.error("❌ Proxy error:", err.message);
    console.error("   URL:", targetUrl);
    console.error("   Status:", err.response?.status);
    
    res.status(err.response?.status || 500).send({
      error: "Proxy failed",
      message: err.message,
      url: targetUrl,
      status: err.response?.status
    });
  }
});

// Catch-all proxy for any resource
app.use("/fetch/*", async (req, res) => {
  const targetUrl = req.params[0];
  
  if (!targetUrl) return res.status(400).send("❌ No URL provided");
  
  try {
    const response = await axios.get(targetUrl, {
      headers: {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
        "Accept": "*/*",
        "Accept-Language": "en-US,en;q=0.9",
        "Accept-Encoding": "gzip, deflate, br",
        "Referer": "https://www.808ball6.com/",
        "Origin": "https://www.808ball6.com",
        "Sec-Fetch-Dest": "empty",
        "Sec-Fetch-Mode": "cors",
        "Sec-Fetch-Site": "cross-site"
      },
      responseType: "arraybuffer",
      timeout: 30000,
      validateStatus: () => true
    });
    
    res.setHeader("Content-Type", response.headers["content-type"] || "application/octet-stream");
    res.setHeader("Access-Control-Allow-Origin", "*");
    res.send(response.data);
    
  } catch (err) {
    console.error("❌ Fetch error:", err.message);
    res.status(500).send({ error: "Fetch failed", message: err.message });
  }
});

// POST proxy for form submissions or API calls
app.post("/proxy", async (req, res) => {
  const { url } = req.query;
  const body = req.body;
  
  if (!url) return res.status(400).send("❌ Missing ?url param");
  
  const targetUrl = decodeURIComponent(url);
  
  try {
    const response = await axios.post(targetUrl, body, {
      headers: {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
        "Content-Type": "application/json",
        "Accept": "*/*",
        "Referer": "https://www.808ball6.com/",
        "Origin": "https://www.808ball6.com"
      },
      validateStatus: () => true
    });
    
    res.status(response.status).json(response.data);
  } catch (err) {
    res.status(500).send({ error: "POST proxy failed", message: err.message });
  }
});

const PORT = process.env.PORT || 7860;
app.listen(PORT, () => {
  console.log(`\n🚀 Proxy Server Running`);
  console.log(`📡 Port: ${PORT}`);
  console.log(`🌐 Endpoints:`);
  console.log(`   • GET  / (health check)`);
  console.log(`   • GET  /proxy?url=<target>`);
  console.log(`   • GET  /fetch/<target>`);
  console.log(`   • POST /proxy?url=<target>`);
});

	import express from "express";
	import axios from "axios";
	import cors from "cors";

	const app = express();

	// Enable CORS for all routes
	app.use(cors());

	// Parse JSON bodies
	app.use(express.json());

	// Health check
	app.get("/", (req, res) => res.send("🔥 Advanced Proxy Server Live"));

	// Main proxy endpoint with aggressive spoofing
	app.get("/proxy", async (req, res) => {
	const { url, matchId, home, away, referer } = req.query;

	if (!url) return res.status(400).send("❌ Missing ?url param");

	const targetUrl = decodeURIComponent(url);

	// Dynamic referer generation
	const customReferer = referer \|\|
	(matchId && home && away
	? `https://www.808ball6.com/football/${matchId}-${home}-vs-${away}.html`
	: "https://www.808ball6.com/");

	// Extract domain from target URL for origin spoofing
	const urlObj = new URL(targetUrl);
	const targetOrigin = `${urlObj.protocol}//${urlObj.hostname}`;

	try {
	const response = await axios.get(targetUrl, {
	headers: {
	// Browser identification
	"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",

	// Accept headers
	"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7",
	"Accept-Language": "en-US,en;q=0.9,es;q=0.8,fr;q=0.7",
	"Accept-Encoding": "gzip, deflate, br, zstd",

	// Referer and Origin
	"Referer": customReferer,
	"Origin": targetOrigin,

	// Connection
	"Connection": "keep-alive",

	// Security/Fetch metadata
	"Sec-Fetch-Dest": "iframe",
	"Sec-Fetch-Mode": "navigate",
	"Sec-Fetch-Site": "cross-site",
	"Sec-Fetch-User": "?1",

	// Chrome-specific headers
	"Sec-Ch-Ua": '"Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"',
	"Sec-Ch-Ua-Mobile": "?0",
	"Sec-Ch-Ua-Platform": '"Windows"',
	"Sec-Ch-Ua-Arch": '"x86"',
	"Sec-Ch-Ua-Bitness": '"64"',
	"Sec-Ch-Ua-Full-Version-List": '"Google Chrome";v="131.0.6778.86", "Chromium";v="131.0.6778.86", "Not_A Brand";v="24.0.0.0"',

	// Additional realistic headers
	"Upgrade-Insecure-Requests": "1",
	"DNT": "1",
	"Cache-Control": "max-age=0",
	"Priority": "u=0, i",

	// Cookie forwarding (if provided)
	...(req.headers.cookie && { "Cookie": req.headers.cookie }),

	// Cloudflare bypass headers
	"CF-Connecting-IP": "8.8.8.8",
	"X-Forwarded-For": "8.8.8.8",
	"X-Real-IP": "8.8.8.8",
	"X-Forwarded-Host": urlObj.hostname,
	"X-Forwarded-Proto": "https",

	// Additional anti-detection
	"Device-Memory": "8",
	"Viewport-Width": "1920",
	"DPR": "1"
	},
	responseType: "arraybuffer",
	maxRedirects: 10,
	validateStatus: () => true,
	timeout: 30000,
	decompress: true,

	// Proxy configuration (if needed)
	// proxy: false, // Disable if you don't have a proxy

	// HTTP/2 support
	httpAgent: false,
	httpsAgent: false
	});

	// Set response headers
	const contentType = response.headers["content-type"] \|\| "text/html; charset=utf-8";

	// Remove anti-iframe headers
	const headersToRemove = [
	"x-frame-options",
	"content-security-policy",
	"content-security-policy-report-only",
	"x-content-security-policy",
	"x-webkit-csp",
	"strict-transport-security"
	];

	// Copy safe headers
	Object.keys(response.headers).forEach(key => {
	if (!headersToRemove.includes(key.toLowerCase())) {
	res.setHeader(key, response.headers[key]);
	}
	});

	res.setHeader("Content-Type", contentType);
	res.setHeader("Access-Control-Allow-Origin", "*");
	res.setHeader("Access-Control-Allow-Methods", "*");
	res.setHeader("Access-Control-Allow-Headers", "*");
	res.setHeader("X-Frame-Options", "ALLOWALL");
	res.setHeader("X-Content-Type-Options", "nosniff");

	// Handle HTML responses with frame-busting prevention
	if (contentType.includes("text/html")) {
	let html = response.data.toString("utf-8");

	// Aggressive frame-busting prevention
	const antiFrameBust = `
	<script>
	(function() {
	// Freeze top and parent
	try {
	Object.defineProperty(window, 'top', {
	get: function() { return window.self; },
	set: function() {},
	configurable: false
	});
	Object.defineProperty(window, 'parent', {
	get: function() { return window.self; },
	set: function() {},
	configurable: false
	});
	Object.defineProperty(window, 'frameElement', {
	get: function() { return null; },
	set: function() {},
	configurable: false
	});

	// Override location checks
	var originalLocation = window.location;
	Object.defineProperty(window, 'location', {
	get: function() { return originalLocation; },
	set: function(val) {
	if (window.self === window.top) {
	originalLocation = val;
	}
	}
	});

	// Disable common frame-busting patterns
	window.onbeforeunload = null;

	// Intercept and block certain navigation attempts
	var _confirm = window.confirm;
	window.confirm = function() { return true; };

	var _alert = window.alert;
	window.alert = function() {};

	} catch(e) {
	console.log('Frame protection applied');
	}
	})();
	</script>
	`;

	// Inject at multiple points for maximum coverage
	html = html.replace(/<!DOCTYPE/i, antiFrameBust + '<!DOCTYPE');
	html = html.replace(/<head>/i, `<head>${antiFrameBust}`);
	html = html.replace(/<head\s/i, `<head>${antiFrameBust} `);

	// If no head tag, inject at start
	if (!/<head/i.test(html)) {
	html = antiFrameBust + html;
	}

	// Rewrite absolute URLs to go through proxy
	html = html.replace(
	/(src\|href)=["'](https?:\/\/[^"']+)["']/gi,
	(match, attr, url) => {
	if (url.includes(urlObj.hostname)) {
	return `${attr}="/proxy?url=${encodeURIComponent(url)}"`;
	}
	return match;
	}
	);

	return res.send(html);
	}

	// For non-HTML content, send as-is
	res.send(response.data);

	} catch (err) {
	console.error("❌ Proxy error:", err.message);
	console.error(" URL:", targetUrl);
	console.error(" Status:", err.response?.status);

	res.status(err.response?.status \|\| 500).send({
	error: "Proxy failed",
	message: err.message,
	url: targetUrl,
	status: err.response?.status
	});
	}
	});

	// Catch-all proxy for any resource
	app.use("/fetch/*", async (req, res) => {
	const targetUrl = req.params[0];

	if (!targetUrl) return res.status(400).send("❌ No URL provided");

	try {
	const response = await axios.get(targetUrl, {
	headers: {
	"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
	"Accept": "/",
	"Accept-Language": "en-US,en;q=0.9",
	"Accept-Encoding": "gzip, deflate, br",
	"Referer": "https://www.808ball6.com/",
	"Origin": "https://www.808ball6.com",
	"Sec-Fetch-Dest": "empty",
	"Sec-Fetch-Mode": "cors",
	"Sec-Fetch-Site": "cross-site"
	},
	responseType: "arraybuffer",
	timeout: 30000,
	validateStatus: () => true
	});

	res.setHeader("Content-Type", response.headers["content-type"] \|\| "application/octet-stream");
	res.setHeader("Access-Control-Allow-Origin", "*");
	res.send(response.data);

	} catch (err) {
	console.error("❌ Fetch error:", err.message);
	res.status(500).send({ error: "Fetch failed", message: err.message });
	}
	});

	// POST proxy for form submissions or API calls
	app.post("/proxy", async (req, res) => {
	const { url } = req.query;
	const body = req.body;

	if (!url) return res.status(400).send("❌ Missing ?url param");

	const targetUrl = decodeURIComponent(url);

	try {
	const response = await axios.post(targetUrl, body, {
	headers: {
	"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
	"Content-Type": "application/json",
	"Accept": "/",
	"Referer": "https://www.808ball6.com/",
	"Origin": "https://www.808ball6.com"
	},
	validateStatus: () => true
	});

	res.status(response.status).json(response.data);
	} catch (err) {
	res.status(500).send({ error: "POST proxy failed", message: err.message });
	}
	});

	const PORT = process.env.PORT \|\| 7860;
	app.listen(PORT, () => {
	console.log(`\n🚀 Proxy Server Running`);
	console.log(`📡 Port: ${PORT}`);
	console.log(`🌐 Endpoints:`);
	console.log(` • GET / (health check)`);
	console.log(` • GET /proxy?url=<target>`);
	console.log(` • GET /fetch/<target>`);
	console.log(` • POST /proxy?url=<target>`);
	});