Captcha Bypass
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
To automate the testing of some functions of the server that allows user input it could be needed to bypass a captcha implementation. Therefore, try to test for these things:
- Do not send the parameter related to the captcha.
- Change from POST to GET or other HTTP Verbs
- Change to JSON or from JSON
- Send the captcha parameter empty.
- Check if the value of the captcha is in the source code of the page.
- Check if the value is inside a cookie.
- Try to use an old captcha value
- Check if you can use the same captcha value several times with the same or different sessionID.
- If the captcha consists on a mathematical operation try to automate the calculation.
- If the captcha consists of read characters from an image, check manually or with code how many images are being used and if only a few images are being used, detect them by MD5.
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!