What problem does it solve?
CAPTCHA controls often look protective but fail under simple logic attacks, leaving login, registration, and password-reset endpoints exposed to brute-force and automation. This Skill guides authorized penetration testers through systematically proving whether a CAPTCHA actually blocks automation or is merely cosmetic.
Core Features & Use Cases
- Token Replay and Freshness Testing: Resend a single solved CAPTCHA token repeatedly to detect missing single-use enforcement and stale-token acceptance.
- Validation Evasion Checks: Remove, empty, or type-confuse the CAPTCHA parameter, and switch HTTP methods or Content-Types to route past middleware bound to one parser.
- Self-Hosted CAPTCHA Attacks: Detect static images, leaked answers in cookies or headers, and OCR-solvable challenges using tesseract.
- Use Case: During an authorized web application pentest, capture one solved reCAPTCHA token on the login form, replay it across ten requests in Burp Intruder, and demonstrate that unlimited password brute-force is possible behind the protected form.
Quick Start
Ask the AI to test whether the CAPTCHA on the target login endpoint can be bypassed using token replay, field removal, and content-type switching with curl and Burp Suite.
