CAPTCHA BYPASS TECHNIQUES !

Q.what is captcha????
according to Wikipedia- A CAPTCHA is a type of challenge-response test used in computing to determine whether or not the user is human. The term was coined in 2003 by Luis von Ahn, Manuel Blum, Nicholas J. Hopper, and John Langford. The most common type of CAPTCHA was first invented in 1997 by two groups working in parallel.
NOTE: In simple words, it is a way to avoid bots.

Q.why captcha bypass
An attacker can create a bot to bypass the captcha and automate the tasks to sent unlimited requests to multiple URLs or lists with random/fake users, emails, IP address.. for spamming or evil purposes (collect data, analyze traffic behaviors, etc)
NOTE: an attacker can perform rate limiting or can use bots.

methods I used to bypass:

1.changing request methods

It is an easy method to check for bypassing captcha just by changing the “request method of your request” and removing the captcha parameter
ex- POST — — -> GET (POST request to GET) #more preferable
POST — — → PUT (POST request to put)

I found more the 5 captcha bypasses on the programs using this technique.

2. just removing the parameter or using the previously used captcha:

This does not work always but at least give it a try, maybe you hit the right spot.

actually, till now I have got only one bypass of this kind.

3.json to normal request:

Sometimes you found that parameters are passing using JSON data. You can first convert it in a simple post request and try or combine it with the 1st method.

I got paid 200$ for bypassing this kind of captcha

4. Using extra headers for rate limiting.

There are some headers that you can use to bypass captcha/rate-limiting.

headers: X-Originating-IP: 127.0.0.1
X-Forwarded-For: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1

if this does not work try to use “x-forwarded-for: 127.0.0.1” twice.
this worked for me.

I got a rate-limiting bug using this.

thanks to @huzaifa_tahir

that’s all, for now, happy hunting
#bugbountytips #bughunting