Thread by @harshbothra_

#learn365 Day-31: Captcha Bypass Techniques

Captcha is widely adapted by the applications to avoid automated attempts on specific functionality, commonly on the Authentication forms to avoid brute-force attacks.

#bugbountytips #appsec #infosec #Pentesting

(1/n)

(2/n)
However, it is possible to bypass Captcha, and sometimes if the function is critical, it can be paid well in terms of bounties.

1. Missing Server-Sides Validation
- Some apps send Captcha Parameters on the client-side but they do not validate this on the server side.

(3/n)
- Simply, Remove the "Captcha" parameters and see if the request is processed successfully.
- If yes, you can now use this request to perform your brute-force or rate-limiting attempts.

(4/n)
2. Missing Captcha Field Integrity Checks
- There are multiple scenarios around this one, this happens when the application validates whether the captcha parameters are present but not the "value".
- Send an empty captcha parameter and see if the request works successfully.

(5/n)
- Change some specific characters of the captcha parameter and see if it is possible to bypass the restriction. This usually happens when only string length is validated at the server-side.

(6/n)
3. HTTP Verb Manipulation
- If a request with the POST method is using the Captcha, try changing the verb(method) from POST to GET and remove the captcha parameter.
- Often this bypasses the restrictions if the validation on the server-side are not in place.

(7/n)
4. Content Type Conversion

- Change the content type say from JSON to Plain Text and remove the captcha parameters to see if the request works successfully.

5. Reusuable Captcha
- Just repeat the request using the same Captcha key multiple times and see if that works.

(8/n)
- One of my weird findings was, Capture the Request in Burp Proxy and send it to Intruder. Hold the request in Proxy Tool don't let it go.
- Run the Intruder and observed that the same captcha can be reused any no. time until you drop off the original request from proxy.

(9/n)
6. Using HTTP Request Headers
- Using Headers such as X-Forwarded-For, X-Original-IP, etc. you can try to bypass the Captcha in some cases.

7. Some Other Techniques
- Automated Captcha Solving Techniques such as OCR Enabled Bots and Human-Based Captcha Solving Services.

(n/n)
# References
- book.hacktricks.xyz/pentesting-web…
- medium.com/@honeyakshat99…
- cobalt.io/vulnerability-…
- medium.com/bugbountywrite…
- codementor.io/@harshittyagi/…
- blackhat.com/docs/asia-16/m…
- iosrjournals.org/iosr-jce/paper…