hunt-captcha-bypass

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

1. Ask the user to state the exact target URL, IP, account, or resource.
2. Ask the user to confirm written authorization and the permitted scope.
3. Show the exact command(s) and explain their expected effect.
4. Wait for explicit confirmation in the current conversation.

Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

Autonomous Testing Priority

The fastest test: just omit the CAPTCHA field entirely. Most CAPTCHA bypass bugs are client-side-only validation.

Pattern 1 — Omit the CAPTCHA field (most common, most automatable):

1. GET the form/endpoint that shows a CAPTCHA to understand its field name (usually g-recaptcha-response, captcha, captcha_token, captcha_answer, h-captcha-response)
2. POST the form with ALL fields EXCEPT the CAPTCHA field
3. If the action succeeds (200, redirect, or "success" message) → no server-side CAPTCHA validation
4. Proof: the state-changing action completes without a valid CAPTCHA field (compare against a baseline request that includes it)

Pattern 2 — Empty or null CAPTCHA value: Instead of omitting the field entirely, include it with an empty string, null, 0, or undefined:

captcha=&email=test@example.com&password=test123

Some apps validate field presence but not content.

Pattern 3 — Replay a previously solved CAPTCHA token:

1. Complete one legitimate CAPTCHA challenge and capture the g-recaptcha-response token
2. Submit a second request immediately with the SAME token value
3. If the second submission also succeeds → token is not single-use (replay attack)
4. A replayed token can be shared across automated requests

Pattern 4 — Test without CAPTCHA on similar endpoints: Some apps add CAPTCHA to the registration form but forget the password reset, API endpoint, or mobile API path (/api/register vs /register). Try the same action via the API path without any CAPTCHA field.

Pattern 5 — Rate/throughput-gated "prove you're automated" challenges: Some apps define CAPTCHA "bypass" as simply exceeding the rate a human could plausibly sustain — e.g. "N submissions within T seconds" — checked by a middleware that counts REQUESTS REACHING the route, not successful outcomes. Garbage/placeholder payloads satisfy this exactly as well as valid ones, since the counter increments regardless of whether the request's own validation passes.

Timing note (sliding-window counters): don't solve this one request at a time — a sequential pace (seconds between each request) structurally cannot land N requests inside a short sliding window, and issuing more requests serially does not fix it. A typical failing pattern is 12 requests spread across ~250 seconds when the check requires ~10 requests within 20 seconds. Instead fire the requests concurrently (e.g. "concurrency": N on a single request call, or any parallel-request primitive your tooling offers, with N >= the required count) so they arrive simultaneously and satisfy the sliding window trivially. Check the endpoint's own required-field validation first (e.g. a rating field that can't be null) so the concurrent payload is at least well-formed enough to reach the counting middleware, even if other fields (like the CAPTCHA answer itself) are wrong or reused.

What to skip in automated testing: Solving real reCAPTCHA/hCaptcha programmatically (OCR, audio bypass) requires external services. Only attempt if patterns 1-4 fail and the test budget allows.

Proof: Any successful state-changing action (account created, login succeeded, form submitted) that completed without a valid CAPTCHA token confirms the bypass.

Vulnerability Classes in This Skill

1. Client-Side-Only CAPTCHA Validation

JavaScript hides/disables the submit button until CAPTCHA is solved, but the server never checks the CAPTCHA token. Direct API calls bypass the UI gate entirely.

2. CAPTCHA Not Tied to Session or Action

…