Captcha

Captchas are no different from any other sub process within a web app. They can be implemented with logic flaws, leak data, and make assumptions on user activity. There are also several projects that defeat captcha without looking outside the box but by using ML/AI. Some of the Captcha bypassing methods and tools are listed below:

• http://cintruder.sourceforge.net/

• http://www.debasish.in/2012/01/bypass-captcha-using-python-and.html

• http://www.boyter.org/decoding-captchas/

• https://www.owasp.org/index.php/Testing_for_Captcha

There are also some less morally sound ways to defeat captcha that although should not be used by ethical hackers, it is good to understand. It is common that hacking scripts will send the captcha to sweatshops to have humans complete the captcha to let the program continue.

• http://boingboing.net/2012/01/09/virtual-sweatshops-versus-capt.html

• http://www.npr.org/templates/story/story.php?storyId=130594039

• http://krebsonsecurity.com/2012/01/virtual-sweatshops-defeat-bot-or-not-tests/