{"id":"hunt-captcha-bypass","name":"hunt-captcha-bypass","summary":"Hunt CAPTCHA Bypass — 6つの異なるパターン:(1) CAPTCHAフィールドがリクエストから単純に省略された場合(サーバー側の検証なし)、(2) 解決済みチャレンジからCAPTCHAトークンが再プレイされた場合(単回使用強制なし)、(3) CAPTCHA応答が解決されたエンドポイントとは異なるエ…","body":"## Autonomous Testing Priority\n\n**The fastest test: just omit the CAPTCHA field entirely. Most CAPTCHA bypass bugs are client-side-only validation.**\n\n**Pattern 1 — Omit the CAPTCHA field (most common, most automatable):**\n1. GET the form/endpoint that shows a CAPTCHA to understand its field name (usually `g-recaptcha-response`, `captcha`, `captcha_token`, `captcha_answer`, `h-captcha-response`)\n2. POST the form with ALL fields EXCEPT the CAPTCHA field\n3. If the action succeeds (200, redirect, or \"success\" message) → no server-side CAPTCHA validation\n4. Proof: the state-changing action completes without a valid CAPTCHA field (compare against a baseline request that includes it)\n\n**Pattern 2 — Empty or null CAPTCHA value:**\nInstead of omitting the field entirely, include it with an empty string, `null`, `0`, or `undefined`:\n```\ncaptcha=&email=test@example.com&password=test123\n```\nSome apps validate field presence but not content.\n\n**Pattern 3 — Replay a previously solved CAPTCHA token:**\n1. Complete one legitimate CAPTCHA challenge and capture the `g-recaptcha-response` token\n2. Submit a second request immediately with the SAME token value\n3. If the second submission also succeeds → token is not single-use (replay attack)\n4. A replayed token can be shared across automated requests\n\n**Pattern 4 — Test without CAPTCHA on similar endpoints:**\nSome apps add CAPTCHA to the registration form but forget the password reset, API endpoint, or mobile API path (`/api/register` vs `/register`). Try the same action via the API path without any CAPTCHA field.\n\n**Pattern 5 — Rate/throughput-gated \"prove you're automated\" challenges:**\nSome apps define CAPTCHA \"bypass\" as simply exceeding the rate a human could plausibly sustain —\ne.g. \"N submissions within T seconds\" — checked by a middleware that counts REQUESTS REACHING the\nroute, not successful outcomes. Garbage/placeholder payloads satisfy this exactly as well as valid\nones, since the counter increments regardless of whether the request's own validation passes.\n\n**Timing note (sliding-window counters):** don't solve this one request at a time — a sequential\npace (seconds between each request) structurally cannot land N requests inside a short sliding\nwindow, and issuing more requests serially does not fix it. A typical failing pattern is 12\nrequests spread across ~250 seconds when the check requires ~10 requests within 20 seconds.\nInstead fire the requests **concurrently** (e.g. `\"concurrency\": N` on a single request call, or\nany parallel-request primitive your tooling offers, with N >= the required count) so they arrive\nsimultaneously and satisfy the sliding window trivially. Check the endpoint's own\nrequired-field validation first (e.g. a `rating` field that can't be null) so the concurrent\npayload is at least well-formed enough to reach the counting middleware, even if other fields\n(like the CAPTCHA answer itself) are wrong or reused.\n\n**What to skip in automated testing:** Solving real reCAPTCHA/hCaptcha programmatically (OCR, audio bypass) requires external services. Only attempt if patterns 1-4 fail and the test budget allows.\n\n**Proof:** Any successful state-changing action (account created, login succeeded, form submitted) that completed without a valid CAPTCHA token confirms the bypass.\n\n---\n\n## Vulnerability Classes in This Skill\n\n### 1. Client-Side-Only CAPTCHA Validation\nJavaScript hides/disables the submit button until CAPTCHA is solved, but the server never checks the CAPTCHA token. Direct API calls bypass the UI gate entirely.\n\n### 2. CAPTCHA Not Tied to Session or Action\nA token solved for login is accepted on the registration endpoint (or any other). The server validates \"is this a real CAPTCHA solution?\" but not \"is this the right solution for THIS action?\".\n\n### 3. Single-Use Not Enforced\nCAPTCHA tokens (especially reCAPTCHA v2) are meant to be consumed after one use. If the server doesn't revoke them after verification, a single human-solved token becomes reusable for many requests.\n\n### 4. CAPTCHA Added Reactively (Only After N Failures)\nSome apps only show CAPTCHA after 3-5 failed login attempts. Before that threshold, no CAPTCHA is required → an attacker can make N-1 attempts per account indefinitely by resetting state between attempts.\n\n### 5. Static or Predictable CAPTCHA\nMath CAPTCHAs (`3 + 4 = ?`), simple image CAPTCHAs, or text CAPTCHAs with a finite answer set can be automated. These are custom CAPTCHA implementations, not Google/hCaptcha.\n\n---\n\n## Impact Chain\n\nCAPTCHA bypass alone: **Medium** (enables automation of rate-limited actions)\n\nCAPTCHA bypass + login endpoint = **brute force gate removed** → chain with `hunt-brute-force` → High/Critical\n\nCAPTCHA bypass + registration endpoint = **account farming** → abuse, spam, resource exhaustion\n\nCAPTCHA bypass + password reset = **token flooding** → chain with `hunt-forgot-password`\n\n---\n\n## Related Skills\n\n- **`hunt-brute-force`** — CAPTCHA is often the only rate-limit gate; bypass unlocks brute force\n- **`hunt-forgot-password`** — reset endpoints sometimes protected by CAPTCHA only\n- **`hunt-race-condition`** — race the CAPTCHA validation window (submit before the token is revoked)","author":"@elementalsouls","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-captcha-bypass","license":"MIT","category":"testing","lang":"en","tokens":1142,"stars":0,"calls30d":1,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":[]}}