Other nomination

Bypassing NoCAPTHCA

Egor Homakov · homakov.blogspot.com

Google's No CAPTCHA reCAPTCHA is really a cookie-based whitelist: trusted users get a token, everyone else still solves the old OCR-breakable challenge. The widget can be loaded with another site's sitekey, its referrer check defeated by a meta referrer tag, so an attacker can clickjack trusted visitors into minting tokens to spend on the victim.

Record

Researcher

Egor Homakov

Published by

homakov.blogspot.com

In the archive

• Nominated for the 2014 Top 10 Web Hacking Techniques

Related sources

• Companion demonstration

Tags

• clickjacking
• ui-redress
• auth-bypass
• iframe
• cookie
• javascript
• owasp-a01-2021
• owasp-a04-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Egor Homakov, first published at the original source. Preserved copies are kept so the citation survives its host.