Skip to content
capzy
Get Started
F5 BIG-IP Advanced WAF
AntiF5Task
proxy required

F5 BIG-IP Advanced WAF Solver, solved in 5.0s.

Bypass F5 BIG-IP Advanced WAF bot protection. Returns TS / TSPD / f5avr trust cookies. IP-bound, replay through the same proxy.

Get API KeyTry Demo
Avg Speed~5.0s
Success99%+
Cost / 1k$2.00
Throughput12/m

F5 BIG-IP Advanced WAF (formerly ASM) protects enterprise and government sites with an inline JavaScript challenge plus cookie-state validation. On first request the server seeds partial TS / TSPD cookies and serves an obfuscated bobcmn script. The script decodes a custom-encoded payload, runs the proof computation, and writes the verified token back to the cookie — subsequent requests with the verified cookie pass the WAF. Note: F5 BIG-IP AWAF is a different product from F5 Distributed Cloud Bot Defense (ex-Shape Security). This solver targets classic AWAF — government services, banking portals, healthcare logins. Distributed Cloud Bot Defense is a separate product we don't yet support.

Quick Integration

solve.py
import requests, time

API = "https://api.capzy.ai"
KEY = "capzy_your_key_here"

# Step 1: Create task
task = requests.post(f"{API}/createTask", json={
    "clientKey": KEY,
    "task": {
        "type": "AntiF5Task",
        "websiteURL": "https://onlineservices.example.gov/login",
        "proxyType": "http",
        "proxyAddress": "123.45.67.89",
        "proxyPort": "8080",
        "proxyLogin": "user",
        "proxyPassword": "pass"
    }
}).json()

task_id = task["taskId"]
print(f"Task created: {task_id}")

# Step 2: Poll for result
while True:
    result = requests.post(f"{API}/getTaskResult", json={
        "clientKey": KEY,
        "taskId": task_id
    }).json()

    if result["status"] == "ready":
        print("Solved!", result["solution"])
        break
    elif result["status"] == "failed":
        print("Failed:", result.get("errorDescription"))
        break

    time.sleep(1)

Using the result

use_result.py
# Step 3: Use the result — set every cookie on a session jar
sol = result["solution"]
session = requests.Session()
for c in sol["cookies"]:
    session.cookies.set(c["name"], c["value"], domain=c.get("domain"), path=c.get("path", "/"))
session.headers["User-Agent"] = sol.get("userAgent", "")
# IMPORTANT: route through the SAME proxy you supplied at solve time
resp = session.get("https://target.example.com/", proxies={
    "http":  "http://USER:PASS@PROXY_HOST:PORT",
    "https": "http://USER:PASS@PROXY_HOST:PORT",
})
print(resp.status_code, len(resp.text), "bytes")

1. Send Payload

Dispatch your AntiF5Task to our processing cluster via the secure API endpoint.

2. Solving Engine

Capzy's proprietary solver returns the validated TS / TSPD / f5avr trust cookies plus the matching User-Agent. AntiF5Task uses your own proxy; AntiF5TaskProxyLess is routed for you by default.

3. Get Result

Poll getTaskResult for the validated token, then finalize your automated request.

Task Parameters

API Spec
Proxy fields below are required for this captcha — userAgent must match the one you’ll use when submitting the resulting token.
typetypestringreqyesAntiF5TaskProxyLess (routed for you) or AntiF5Task (your proxy)
websiteURLtypestringreqyesThe F5 BIG-IP-protected page URL
proxyTypetypestringreqyesProxy protocol: http, https, socks4, or socks5
proxyAddresstypestringreqyesProxy IP address or hostname
proxyPorttypenumberreqyesProxy port number
proxyLogintypestringreqnoProxy username (if auth required)
proxyPasswordtypestringreqnoProxy password (if auth required)
userAgenttypestringreqnoUser-Agent string to use. Must match the UA you use when submitting the token

Response Shape

cookiestypearrayArray of cookie objects including TS<hash>, TSPD_*, f5avr…_session_
userAgenttypestringUser-Agent used — must match when reusing cookies

Example response

{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "cookies": [
      {
        "name": "TSaa03129d029",
        "value": "<long F5 TS verified cookie>",
        "domain": "onlineservices.example.gov",
        "path": "/"
      },
      {
        "name": "TS351d4aa7027",
        "value": "<F5 TS cookie>",
        "domain": "onlineservices.example.gov",
        "path": "/"
      },
      {
        "name": "f5avraaaaaaaaaaaaaaaa_session_",
        "value": "<F5 session id>",
        "domain": "onlineservices.example.gov",
        "path": "/"
      },
      {
        "name": "TSaa03129d075",
        "value": "<F5 verification cookie>",
        "domain": "onlineservices.example.gov",
        "path": "/"
      }
    ],
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
  }
}

Error response

{
  "errorId": 1,
  "errorCode": "ERROR_CAPTCHA_UNSOLVABLE",
  "errorDescription": "Solver gave up."
}

Features

Solves the F5 bobcmn JavaScript challenge end-to-end
Captures TS<hash> + TSPD_* + f5avr session cookies
Routed for you (ProxyLess) by default — F5 deployments are tight on low-trust IPs
Solve time 4-8 s comparable to Imperva token path
Cookies are IP + UA bound — full replay payload returned

Pricing & Stats

Per 1,000 solves$2.00
Avg solve time~5.0s
Success rate99%+
Throughput12/m

Start solving f5 big-ip advanced waf.

$0.10 in free credits — no card. ~250 free solves to test before you spend.

Get free API key Read docs

Frequently asked questions