Applicable Scenarios
Use when captchas block endpoints such as login, registration, password reset, and SMS sending.
Phase 1: Captcha Type Identification
| Type | Characteristics | Bypass Approach |
|---|---|---|
| Image digits/letters | 4-6 character image | OCR/captcha-solving platform/logic bypass |
| Click type (click captcha) | Click text/shapes in the image as prompted | Coordinate parsing + simulated clicks |
| Slider | Drag puzzle piece | Trajectory simulation/gap identification |
| Arithmetic/Chinese | Directly readable | Regex extraction and direct answer |
Phase 2: Recognition and Automation Solutions
- OCR recognition: tesseract or captcha-solving platforms to recognize image captchas
- Click captcha: parse the coordinates of the prompt text and click according to the coordinates (selenium/requests simulation)
- Slider: identify the gap position to generate a drag trajectory and bypass front-end trajectory validation
Phase 3: Logic Bypass (Try First)
- Captcha reuse: use the same code multiple times
- Captcha echo: returned directly in the response/JS
- Null value/delete parameter: set code to empty, delete the captcha parameter
- Universal captcha: fixed value (such as 0000, 8888)
- Concurrency bypass: captcha not invalidated after validation, concurrent replay
- Front-end validation: only validated in JS, bypass by directly calling the backend endpoint
Phase 4: Rate Limit Bypass
- Rate limiting on captcha sending/validation endpoints: IP rotation, parameter pollution, concurrency
- When brute-forcing captchas, be careful of triggering lockout/ban
Authorization Boundaries
- Only for authorized penetration testing
- Brute-forcing must control the rate to avoid affecting business
Related
- Password reset/SMS verification code logic → password-reset-methodology