hunt-captcha-bypass

Name: hunt-captcha-bypass
Author: elementalsouls

3.0kstars461forks

How to install hunt-captcha-bypass?

elementalsouls/claude-bughunter/hunt-captcha-bypass

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-captcha-bypass

Installs into the current project.

Summary

Hunt CAPTCHA Bypass — 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation absent), (2) CAPTCHA token replayed from a solved challenge (no single-use enforcement), (3) CAPTCHA response accepted on a different endpoint than it was solved o

Files · 1

View on GitHub

SKILL.md

1	## Autonomous Testing Priority
2
3	The fastest test: just omit the CAPTCHA field entirely. Most CAPTCHA bypass bugs are client-side-only validation.
4
5	Pattern 1 — Omit the CAPTCHA field (most common, most automatable):
6	1. GET the form/endpoint that shows a CAPTCHA to understand its field name (usually `g-recaptcha-response`, `captcha`, `captcha_token`, `captcha_answer`, `h-captcha-response`)
7	2. POST the form with ALL fields EXCEPT the CAPTCHA field
8	3. If the action succeeds (200, redirect, or "success" message) → no server-side CAPTCHA validation
9	4. Proof: the state-changing action completes without a valid CAPTCHA field (compare against a baseline request that includes it)
10
11	Pattern 2 — Empty or null CAPTCHA value:
12	Instead of omitting the field entirely, include it with an empty string, `null`, `0`, or `undefined`:
13	```
14	captcha=&email=test@example.com&password=test123
15	```
16	Some apps validate field presence but not content.
17
18	Pattern 3 — Replay a previously solved CAPTCHA token:
19	1. Complete one legitimate CAPTCHA challenge and capture the `g-recaptcha-response` token
20	2. Submit a second request immediately with the SAME token value
21	3. If the second submission also succeeds → token is not single-use (replay attack)
22	4. A replayed token can be shared across automated requests
23
24	Pattern 4 — Test without CAPTCHA on similar endpoints:
25	Some apps add CAPTCHA to the registration form but forget the password reset, API endpoint, or mobile API path (`/api/register` vs `/register`). Try the same action via the API path without any CAPTCHA field.
26
27	Pattern 5 — Rate/throughput-gated "prove you're automated" challenges:
28	Some apps define CAPTCHA "bypass" as simply exceeding the rate a human could plausibly sustain —
29	e.g. "N submissions within T seconds" — checked by a middleware that counts REQUESTS REACHING the
30	route, not successful outcomes. Garbage/placeholder payloads satisfy this exactly as well as valid
31	ones, since the counter increments regardless of whether the request's own validation passes.
32
33	Timing note (sliding-window counters): don't solve this one request at a time — a sequential
34	pace (seconds between each request) structurally cannot land N requests inside a short sliding
35	window, and issuing more requests serially does not fix it. A typical failing pattern is 12
36	requests spread across ~250 seconds when the check requires ~10 requests within 20 seconds.
37	Instead fire the requests concurrently (e.g. `"concurrency": N` on a single request call, or
38	any parallel-request primitive your tooling offers, with N >= the required count) so they arrive
39	simultaneously and satisfy the sliding window trivially. Check the endpoint's own
40	required-field validation first (e.g. a `rating` field that can't be null) so the concurrent
41	payload is at least well-formed enough to reach the counting middleware, even if other fields
42	(like the CAPTCHA answer itself) are wrong or reused.
43
44	What to skip in automated testing: Solving real reCAPTCHA/hCaptcha programmatically (OCR, audio bypass) requires external services. Only attempt if patterns 1-4 fail and the test budget allows.
45
46	Proof: Any successful state-changing action (account created, login succeeded, form submitted) that completed without a valid CAPTCHA token confirms the bypass.
47
48	---
49
50	## Vulnerability Classes in This Skill
51
52	### 1. Client-Side-Only CAPTCHA Validation
53	JavaScript hides/disables the submit button until CAPTCHA is solved, but the server never checks the CAPTCHA token. Direct API calls bypass the UI gate entirely.
54
55	### 2. CAPTCHA Not Tied to Session or Action
56	A token solved for login is accepted on the registration endpoint (or any other). The server validates "is this a real CAPTCHA solution?" but not "is this the right solution for THIS action?".
57
58	### 3. Single-Use Not Enforced
59	CAPTCHA tokens (especially reCAPTCHA v2) are meant to be consumed after one use. If the server doesn't revoke them after verification, a single human-solved token becomes reusable for many requests.
60
61	### 4. CAPTCHA Added Reactively (Only After N Failures)
62	Some apps only show CAPTCHA after 3-5 failed login attempts

People who liked this also viewed

6 picks

Type

hunt-captcha-bypass

3.0kstars461forks

View on GitHub

How to install hunt-captcha-bypass?

elementalsouls/claude-bughunter/hunt-captcha-bypass

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-captcha-bypass

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	## Autonomous Testing Priority
2
3	The fastest test: just omit the CAPTCHA field entirely. Most CAPTCHA bypass bugs are client-side-only validation.
4
5	Pattern 1 — Omit the CAPTCHA field (most common, most automatable):
6	1. GET the form/endpoint that shows a CAPTCHA to understand its field name (usually `g-recaptcha-response`, `captcha`, `captcha_token`, `captcha_answer`, `h-captcha-response`)
7	2. POST the form with ALL fields EXCEPT the CAPTCHA field
8	3. If the action succeeds (200, redirect, or "success" message) → no server-side CAPTCHA validation
9	4. Proof: the state-changing action completes without a valid CAPTCHA field (compare against a baseline request that includes it)
10
11	Pattern 2 — Empty or null CAPTCHA value:
12	Instead of omitting the field entirely, include it with an empty string, `null`, `0`, or `undefined`:
13	```
14	captcha=&email=test@example.com&password=test123
15	```
16	Some apps validate field presence but not content.
17
18	Pattern 3 — Replay a previously solved CAPTCHA token:
19	1. Complete one legitimate CAPTCHA challenge and capture the `g-recaptcha-response` token
20	2. Submit a second request immediately with the SAME token value
21	3. If the second submission also succeeds → token is not single-use (replay attack)
22	4. A replayed token can be shared across automated requests
23
24	Pattern 4 — Test without CAPTCHA on similar endpoints:
25	Some apps add CAPTCHA to the registration form but forget the password reset, API endpoint, or mobile API path (`/api/register` vs `/register`). Try the same action via the API path without any CAPTCHA field.
26
27	Pattern 5 — Rate/throughput-gated "prove you're automated" challenges:
28	Some apps define CAPTCHA "bypass" as simply exceeding the rate a human could plausibly sustain —
29	e.g. "N submissions within T seconds" — checked by a middleware that counts REQUESTS REACHING the
30	route, not successful outcomes. Garbage/placeholder payloads satisfy this exactly as well as valid
31	ones, since the counter increments regardless of whether the request's own validation passes.
32
33	Timing note (sliding-window counters): don't solve this one request at a time — a sequential
34	pace (seconds between each request) structurally cannot land N requests inside a short sliding
35	window, and issuing more requests serially does not fix it. A typical failing pattern is 12
36	requests spread across ~250 seconds when the check requires ~10 requests within 20 seconds.
37	Instead fire the requests concurrently (e.g. `"concurrency": N` on a single request call, or
38	any parallel-request primitive your tooling offers, with N >= the required count) so they arrive
39	simultaneously and satisfy the sliding window trivially. Check the endpoint's own
40	required-field validation first (e.g. a `rating` field that can't be null) so the concurrent
41	payload is at least well-formed enough to reach the counting middleware, even if other fields
42	(like the CAPTCHA answer itself) are wrong or reused.
43
44	What to skip in automated testing: Solving real reCAPTCHA/hCaptcha programmatically (OCR, audio bypass) requires external services. Only attempt if patterns 1-4 fail and the test budget allows.
45
46	Proof: Any successful state-changing action (account created, login succeeded, form submitted) that completed without a valid CAPTCHA token confirms the bypass.
47
48	---
49
50	## Vulnerability Classes in This Skill
51
52	### 1. Client-Side-Only CAPTCHA Validation
53	JavaScript hides/disables the submit button until CAPTCHA is solved, but the server never checks the CAPTCHA token. Direct API calls bypass the UI gate entirely.
54
55	### 2. CAPTCHA Not Tied to Session or Action
56	A token solved for login is accepted on the registration endpoint (or any other). The server validates "is this a real CAPTCHA solution?" but not "is this the right solution for THIS action?".
57
58	### 3. Single-Use Not Enforced
59	CAPTCHA tokens (especially reCAPTCHA v2) are meant to be consumed after one use. If the server doesn't revoke them after verification, a single human-solved token becomes reusable for many requests.
60
61	### 4. CAPTCHA Added Reactively (Only After N Failures)
62	Some apps only show CAPTCHA after 3-5 failed login attempts

People who liked this also viewed

6 picks

Type