Hunt Captcha Bypass
Hunt CAPTCHA Bypass, 6 distinct patterns: (1) CAPTCHA field simply omitted from the...
Install
npx skills add elementalsouls/Claude-BugHunter --skill hunt-captcha-bypass -g -a claude-code -y- Repository
- elementalsouls/Claude-BugHunter5.4k
- Category
- Design
- Updated
- 3d ago
- License
- MIT
- Context cost
- Lightabout 1,299 tokens
- Runs scripts
- No, instructions only
What it does
Hunt CAPTCHA Bypass, 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation absent), (2) CAPTCHA token replayed from a solved challenge (no single-use enforcement), (3) CAPTCHA response accepted on a different endpoint than it was solved on (no binding to action/session), (4) static or predictable CAPTCHA values accepted (e.g. '0', 'null', empty string), (5) audio/accessibility CAPTCHA trivially solvable programmatically, (6) CAPTCHA only enforced after N failures (first N requests bypass it). Detection: intercept a successful form submission, remove the CAPTCHA field entirely, replay, if it still succeeds, server-side validation is absent. Medium severity standalone; High when it removes the only rate-limit gate protecting a login, registration, or payment endpoint.
Autonomous Testing Priority
The fastest test: just omit the CAPTCHA field entirely. Most CAPTCHA bypass bugs are client-side-only validation.
Pattern 1, Omit the CAPTCHA field (most common, most automatable):
- GET the form/endpoint that shows a CAPTCHA to understand its field name (usually
g-recaptcha-response,captcha,captcha_token,captcha_answer,h-captcha-response) - POST the form with ALL fields EXCEPT the CAPTCHA field
- If the action succeeds (200, redirect, or "success" message) → no server-side CAPTCHA validation
- Proof: the state-changing action completes without a valid CAPTCHA field (compare against a baseline request that includes it)
Pattern 2, Empty or null CAPTCHA value:
Instead of omitting the field entirely, include it with an empty string, null, 0, or undefined:
captcha=&email=test@example.com&password=test123
Some apps validate field presence but not content.
Pattern 3, Replay a previously solved CAPTCHA token:
- Complete one legitimate CAPTCHA challenge and capture the
g-recaptcha-responsetoken - Submit a second request immediately with the SAME token value
- If the second submission also succeeds → token is not single-use (replay attack)
- A replayed token can be shared across automated requests
Pattern 4, Test without CAPTCHA on similar endpoints:
Some apps add CAPTCHA to the registration form but forget the password reset, API endpoint, or mobile API path (/api/register vs /register). Try the same action via the API path without any CAPTCHA field.
