I'm inspecting web page and using Burp suite to intercept HTTP requests made by JS. For certain URL I receive 403 status and Claudflare's page with message "Please turn JavaScript on and reload the page". JS is turned on in my browser (Firefox) and that URL works fine with disabled proxy.
How Cloudflare detects Burp and how to bypass it?
Since you received status code 403, it is safe to assume you got blocked by Cloudflare.
There are several ways to detect you. When the website is protected by Cloudflare, the connected client will try to pass several challenges. But it's not limited to that, your client's behavior will also be analyzed while you're visiting the webpage.
It's also possible to detect specifically Burp users, here are several reasons:
br in the Accept-Encoding header. So you should check the sent requests’ headers, especially Accept-Encoding.Burp is Chromium, this can also be seen from the User-Agent. You can see an example Burp User-Agent:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36It also doesn't spoof the navigator.platform property, so if the user isn't running on Windows, the platform can detect you.
Also if the user is running on Windows, since the sec-ch-ua header carries the browser information. In Burp, this will only include Chromium rather than Google Chrome or any chromium-based browser. Since most users won't be using Chromium, you’ll get detected.
You can change the User-Agent and other headers from: Proxy -> Options -> Match and Replace feature. You can add your custom User-Agents and play with other request headers to bypass the WAF.
For more information about Cloudflare: bypassing Cloudflare.