gpt-pp-team-protocol-replay

What this skill does

# gpt-pp-team Protocol Replay Toolkit

> Skill by [ara.so](https://ara.so) — Daily 2026 Skills collection.

End-to-end protocol replay toolkit for ChatGPT Team subscription covering `Stripe Checkout → PayPal billing agreement → ChatGPT manual-approval → Codex OAuth + PKCE`. Includes a from-scratch hCaptcha visual solver (12 challenge types) and empirical anti-fraud research data.

> ⚠️ **For authorized security research, CTF, and bug bounty in-scope assets only.** Read `NOTICE` before use.

---

## Installation

```bash
git clone https://github.com/DanOps-1/gpt-pp-team
cd gpt-pp-team
pip install requests curl_cffi playwright camoufox browserforge mitmproxy pybase64
playwright install firefox
camoufox fetch
```

### ML dependencies for hCaptcha solver (separate venv, ~4 GB)

```bash
python -m venv ~/.venvs/ctfml
~/.venvs/ctfml/bin/pip install torch transformers opencv-python pillow numpy
```

### System requirements

- Linux with Xvfb (for headless browser automation)
- ~5 GB disk, ~2 GB RAM minimum
- EU/US proxy (PayPal region-locked, Stripe country-locked)
- Cloudflare zone for catch-all subdomain email registration

---

## Architecture Overview

```
pipeline.py
  └─> CTF-reg/browser_register.py   (Camoufox + Turnstile)
  └─> CTF-pay/card.py               (Stripe Checkout replay, 8000 lines)
  └─> Stripe confirm + ChatGPT /approve
  └─> Camoufox PayPal billing agreement
  └─> Stripe poll state=succeeded
  └─> Camoufox second login Codex OAuth + PKCE
  └─> output/results.jsonl          (refresh_token)
```

Key files:
| File | Purpose |
|------|---------|
| `pipeline.py` | Orchestrator, daemon loop, 12-self-healing branches |
| `CTF-pay/card.py` | Stripe protocol replay (single file, 8000 lines) |
| `CTF-pay/hcaptcha_auto_solver.py` | hCaptcha VLM solver (~4000 lines, standalone) |
| `CTF-reg/browser_register.py` | Account registration with Camoufox |
| `webui/server.py` | 14-step setup wizard + SSE log controller |

---

## Configuration

### Copy templates

```bash
cp CTF-pay/config.paypal.example.json     CTF-pay/config.paypal.json
cp CTF-reg/config.paypal-proxy.example.json   CTF-reg/config.paypal-proxy.json
```

### Core config fields (`CTF-pay/config.paypal.json`)

```json
{
  "proxy": {
    "host": "your-proxy-host",
    "port": 1080,
    "username": "$PROXY_USER",
    "password": "$PROXY_PASS",
    "protocol": "socks5"
  },
  "paypal": {
    "email": "$PAYPAL_EMAIL",
    "password": "$PAYPAL_PASSWORD",
    "country": "IE"
  },
  "cloudflare": {
    "api_token": "$CF_API_TOKEN",
    "zone_id": "$CF_ZONE_ID",
    "domain": "yourdomain.com"
  },
  "vlm": {
    "api_key": "$VLM_API_KEY",
    "base_url": "$VLM_BASE_URL",
    "model": "gpt-4o"
  },
  "captcha_platform": {
    "api_key": "$CAPTCHA_API_KEY",
    "provider": "2captcha"
  },
  "webshare": {
    "api_key": "$WEBSHARE_API_KEY"
  }
}
```

### Environment variables

```bash
export PROXY_USER="your_proxy_username"
export PROXY_PASS="your_proxy_password"
export PAYPAL_EMAIL="[email protected]"
export PAYPAL_PASSWORD="your_paypal_password"
export CF_API_TOKEN="your_cloudflare_api_token"
export CF_ZONE_ID="your_cloudflare_zone_id"
export VLM_API_KEY="your_openai_compatible_key"
export VLM_BASE_URL="https://api.openai.com/v1"
export WEBSHARE_API_KEY="your_webshare_key"
export CAPTCHA_API_KEY="your_2captcha_key"
```

---

## WebUI Setup Wizard (Recommended for First-Time Setup)

Reduces ~3 hour manual config to ~15 minutes. Generates both config files automatically.

```bash
# Install backend deps
pip install -r webui/requirements.txt

# Build frontend (one-time)
cd webui/frontend && pnpm i && pnpm build && cd ../..

# Start wizard
python -m webui.server
# Open http://127.0.0.1:8765 — redirects to /setup on first visit
```

Features:
- 14-step configuration wizard
- Real-time preflight self-checks
- SSE log streaming for live pipeline monitoring
- Generates `CTF-pay/config.auto.json` + `CTF-reg/config.paypal-proxy.json`

For public access via nginx reverse proxy, see `webui/README.md`.

---

## Running the Pipeline

### Single run

```bash
xvfb-run -a python pipeline.py \
  --config CTF-pay/config.paypal.json \
  --paypal
```

### Daemon mode (continuous pool maintenance)

```bash
xvfb-run -a python pipeline.py \
  --config CTF-pay/config.paypal.json \
  --paypal \
  --daemon
```

### Batch mode

```bash
xvfb-run -a python pipeline.py \
  --config CTF-pay/config.paypal.json \
  --paypal \
  --batch 10
```

### Output

Results written to `output/results.jsonl`:
```json
{"email": "[email protected]", "refresh_token": "...", "timestamp": "2026-04-29T00:00:00Z", "status": "success"}
```

---

## hCaptcha Solver — Standalone Usage

The solver (`CTF-pay/hcaptcha_auto_solver.py`) is independently usable with a 3-layer decision architecture:

1. **VLM primary path** — OpenAI-compatible vision model identifies challenge targets
2. **CLIP/OpenCV heuristic fallback** — local model, no API needed
3. **Human action synthesis** — Playwright realistic mouse movement

### Basic usage

```python
import asyncio
from CTF-pay.hcaptcha_auto_solver import HCaptchaSolver

async def solve_captcha(page):
    solver = HCaptchaSolver(
        page=page,
        vlm_api_key=os.environ["VLM_API_KEY"],
        vlm_base_url=os.environ["VLM_BASE_URL"],
        vlm_model="gpt-4o",
        clip_venv_path=os.path.expanduser("~/.venvs/ctfml"),
        debug=True
    )
    result = await solver.solve()
    return result  # True if solved, False if failed

asyncio.run(solve_captcha(page))
```

### With Playwright + Camoufox

```python
import asyncio
from camoufox.async_api import AsyncCamoufox
from CTF_pay.hcaptcha_auto_solver import HCaptchaSolver

async def main():
    async with AsyncCamoufox(headless=True, humanize=True) as browser:
        page = await browser.new_page()
        await page.goto("https://example.com/page-with-hcaptcha")
        
        solver = HCaptchaSolver(
            page=page,
            vlm_api_key=os.environ["VLM_API_KEY"],
            vlm_base_url=os.environ.get("VLM_BASE_URL", "https://api.openai.com/v1"),
            vlm_model="gpt-4o",
        )
        
        success = await solver.solve()
        if success:
            print("hCaptcha solved successfully")
        else:
            print("Solver failed, check logs")

asyncio.run(main())
```

### Supported challenge types (12)

- Image classification (single/multi-select)
- Bounding box / area selection
- Drag-and-drop alignment
- 3D object rotation
- Text-in-image matching
- Spatial relationship challenges
- Count-based selection
- Sequential ordering
- Color/pattern matching
- Object pair matching
- Scene classification
- Entity attribute verification

### CLIP-only mode (no VLM API)

```python
solver = HCaptchaSolver(
    page=page,
    vlm_api_key=None,          # Disables VLM primary path
    clip_venv_path=os.path.expanduser("~/.venvs/ctfml"),
    fallback_only=True
)
```

---

## Daemon Mode — 12-Self-Healing Branches

`pipeline.py::daemon()` handles these failure conditions automatically:

| Branch | Trigger | Recovery |
|--------|---------|----------|
| IP rotation | Ban detected / probe fail | Webshare API fetch new IP |
| CF DNS quota | Zone record limit hit | Clean stale catch-all records |
| tmpfs orphan | Crashed browser profile left | Reclaim tmpfs mounts |
| gost relay | Relay process died | Restart watchdog |
| DataDome slider | Slider CAPTCHA on registration | Auto-drag synthesis |
| PayPal 2FA | Session expired | Re-authenticate flow |
| Stripe fingerprint | `runtime.version` drift | Re-align JS checksum |
| Batch correlation | Mass ban detected | Pause + stagger restart |
| DNS propagation | New subdomain not resolving | Poll + retry with backoff |
| OAuth PKCE | Token exchange failure | Regenerate challenge |
| Account approval | Manual approval queue | Poll `/approve` endpoint |
| Memory pressure | Browser OOM | Graceful restart with GC |

---

## Anti-Fraud Research Data

Key empirical findings from `docs/ant