hnq90 / ladder

Alternative to 12ft.io. Bypass paywalls with a proxy ladder and remove CORS headers from any URL

Ladder

Ladder is a web proxy to help bypass paywalls. This is a selfhosted version of 1ft.io and 12ft.io. It is inspired by 13ft.

Why

Freedom of information is an essential pillar of democracy and informed decision-making. While media organizations have legitimate financial interests, it is crucial to strike a balance between profitability and the public's right to access information. The proliferation of paywalls raises concerns about the erosion of this fundamental freedom, and it is imperative for society to find innovative ways to preserve access to vital information without compromising the sustainability of journalism. In a world where knowledge should be shared and not commodified, paywalls should be critically examined to ensure that they do not undermine the principles of an open and informed society.

Disclaimer: This project is intended for educational purposes only. The author does not endorse or encourage any unethical or illegal activity. Use this tool at your own risk.

Features

• Bypass Paywalls
• Remove CORS headers from responses, assets, and images ...
• Apply domain based ruleset/code to modify response
• Keep site browsable
• API
• Fetch RAW HTML
• Custom User Agent
• Custom X-Forwarded-For IP
• Docker container (amd64, arm64)
• Linux binary
• Mac OS binary
• Windows binary (untested)
• Removes most of the ads (unexpected side effect ¯_(ツ)_/¯ )
• Basic Auth
• Disable logs
• No Tracking
• Limit the proxy to a list of domains
• Expose Ruleset to other ladders
• Optional TOR proxy
• A key to share only one URL
• Fetch from Google Cache if not available

Limitations

Certain sites may display missing images or encounter formatting issues. This can be attributed to the site's reliance on JavaScript or CSS for image and resource loading, which presents a limitation when accessed through this proxy. If you prefer a full experience, please consider buying a subscription for the site.

Some sites do not expose their content to search engines, which means that the proxy cannot access the content. A future version will try to fetch the content from Google Cache.

Installation

Warning: If your instance will be publicly accessible, make sure to enable Basic Auth. This will prevent unauthorized users from using your proxy. If you do not enable Basic Auth, anyone can use your proxy to browse nasty/illegal stuff. And you will be responsible for it.

Binary

1. Download binary here
2. Unpack and run the binary ./ladder
3. Open Browser (Default: http://localhost:8080)

Docker

docker run -p 8080:8080 -d --name ladder ghcr.io/kubero-dev/ladder:latest

Docker Compose

curl https://raw.githubusercontent.com/kubero-dev/ladder/main/docker-compose.yaml --output docker-compose.yaml
docker-compose up -d

Usage

Browser

1. Open Browser (Default: http://localhost:8080)
2. Enter URL
3. Press Enter

Or direct by appending the URL to the end of the proxy URL: http://localhost:8080/https://www.example.com

API

curl -X GET "http://localhost:8080/api/https://www.example.com"

RAW

http://localhost:8080/raw/https://www.example.com

Running Ruleset

http://localhost:8080/ruleset

Configuration

Environment Variables

Variable	Description	Value
PORT	Port to listen on	8080
PREFORK	Spawn multiple server instances	false
USER_AGENT	User agent to emulate	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
X_FORWARDED_FOR	IP forwarder address	66.249.66.1
USERPASS	Enables Basic Auth, format admin:123456	``
LOG_URLS	Log fetched URL's	true
DISABLE_FORM	Disables URL Form Frontpage	false
FORM_PATH	Path to custom Form HTML	``
RULESET	URL to a ruleset file	https://raw.githubusercontent.com/kubero-dev/ladder/main/ruleset.yaml or /path/to/my/rules.yaml
EXPOSE_RULESET	Make your Ruleset available to other ladders	true
ALLOWED_DOMAINS	Comma separated list of allowed domains. Empty = no limitations	``
ALLOWED_DOMAINS_RULESET	Allow Domains from Ruleset. false = no limitations	false

ALLOWED_DOMAINS and ALLOWED_DOMAINS_RULESET are joined together. If both are empty, no limitations are applied.

Ruleset

It is possible to apply custom rules to modify the response. This can be used to remove unwanted or modify elements from the page. The ruleset is a YAML file that contains a list of rules for each domain and is loaded on startup

See in ruleset.yaml for an example.

- domain: www.example.com
  regexRules:
    - match: <script\s+([^>]*\s+)?src="(/)([^"]*)"
      replace: <script $1 script="/https://www.example.com/$3"
  injections:
    - position: head # Position where to inject the code
      append: | 
        <script>
          window.localStorage.clear();
          console.log("test");
          alert("Hello!");
        </script>
- domain: www.anotherdomain.com # Domain where the rule applies
  paths:                        # Paths where the rule applies
    - /article
  googleCache: false            # Search also in Google Cache
  regexRules:                   # Regex rules to apply
    - match: <script\s+([^>]*\s+)?src="(/)([^"]*)"
      replace: <script $1 script="/https://www.example.com/$3"
  injections:
    - position: .left-content article .post-title # Position where to inject the code into DOM
      replace: | 
        <h1>My Custom Title</h1>
    - position: .left-content article # Position where to inject the code into DOM
      prepend: | 
        <h2>Suptitle</h2>