Captcha Bypass
CAPTCHA bypass testing
During an authorized assessment, test whether the server actually binds a CAPTCHA solution to the intended action, session, challenge, and expiry. A CAPTCHA is a rate-abuse control, not a replacement for authorization, throttling, or account lockout.[1]
- Parameter Manipulation:
- Omit the Captcha Parameter: Avoid sending the captcha parameter. Experiment with changing the HTTP method from POST to GET or other verbs, and altering the data format, such as switching between form data and JSON.
- Send Empty Captcha: Submit the request with the captcha parameter present but left empty.
- Value Extraction and Reuse:
- Source Code Inspection: Search for the captcha value within the page’s source code.
- Cookie Analysis: Examine the cookies to find if the captcha value is stored and reused.
- Reuse Old Captcha Values: Attempt to use previously successful captcha values again. Keep in mind that they might expire at any time.
- Session Manipulation: Try using the same captcha value across different sessions or the same session ID.
- Automation and Recognition:
- Mathematical Captchas: If the captcha involves math operations, automate the calculation process.
- Image Recognition:
- For captchas that require reading characters from an image, manually or programmatically determine the total number of unique images. If the set is limited, you might identify each image by its MD5 hash.
- Use OCR tools such as Tesseract to evaluate whether character challenges are machine-readable.[2]
- Additional Techniques:
- Rate Limit Testing: Check if the application limits the number of attempts or submissions in a given timeframe and whether this limit can be bypassed or reset.
- Third-party Services: Employ captcha-solving services or APIs that offer automated captcha recognition and solving.
- Session and IP rotation: Determine whether limits are bound only to an IP address or session and whether rotating test-owned session IDs or authorized source IPs bypasses the control. Also test whether normal application flows reset the counter. Do not evade third-party controls outside the agreed test scope.
- User-Agent and Header Manipulation: Alter the User-Agent and other request headers to mimic different browsers or devices.
- Audio Captcha Analysis: If an audio captcha option is available, use speech-to-text services to interpret and solve the captcha.
Online CAPTCHA-solving services
CapSolver
CapSolver is one example of a commercial API and browser-extension service that claims support for reCAPTCHA, DataDome, AWS CAPTCHA, GeeTest, and Cloudflare Turnstile. Its client options include extensions for Chrome and Firefox. Treat any external solver as a data processor: test only accounts and challenges covered by the engagement, and do not send sensitive screenshots, tokens, or production user data without approval.[3]