Other nomination

Bypassing CAPTCHAs by Impersonating CAPTCHA Providers

Gursev Singh Kalra · gursevkalra.blogspot.com

CAPTCHA verification APIs, reCAPTCHA included, validated over plain HTTP, so a man in the middle can sniff the private key and impersonate the provider. Because validation answers are a tiny predictable set, the attacker can clip the request and return success himself; the clipcaptcha tool automates this with provider signatures and five operating modes.

Record

Researcher

Gursev Singh Kalra

Published by

gursevkalra.blogspot.com

In the archive

• Nominated for the 2012 Top 10 Web Hacking Techniques

Related sources

• Whitepaper
• clipcaptcha tool
• Research tool
• Talk recording

Tags

• https
• auth-bypass
• tooling
• info-leak
• owasp-a01-2021
• owasp-a02-2021

This page is the archive's own catalogue record. The research is the work of Gursev Singh Kalra, first published at the original source. Preserved copies are kept so the citation survives its host.