skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

captcha-bypass-methodology

Bypass and recognize image, click, and slider captchas during authorized penetration tests.

1.7k|238|Updated Dec 7, 2019
Search Tags:#penetration testing#OCR#brute force#rate limit#authentication testing#CAPTCHA bypass#slider captcha
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill captcha-bypass-methodology
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: captcha-bypass-methodology
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/exploit/auth/captcha-bypass-methodology
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill captcha-bypass-methodology

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized penetration tests, captchas on login, registration, password reset, and SMS-sending endpoints block automated testing and brute-force validation, requiring a structured methodology to identify, recognize, or bypass them.

Core Features & Use Cases

  • Captcha Type Identification: Classify image character captchas, click-based captchas, slider puzzles, and arithmetic/Chinese question captchas, each mapped to a matching bypass strategy.
  • Automated Recognition: Apply OCR (tesseract) or third-party captcha-solving platforms, parse click coordinates for click captchas, and generate drag trajectories for slider captchas.
  • Logic Bypass Techniques: Test captcha reuse, response/JS echo of codes, empty or removed captcha parameters, universal codes, concurrent replay after validation, and frontend-only validation.
  • Use Case: While testing a login endpoint protected by a 4-digit image captcha, first check whether the code can be reused or omitted; if not, pipe the image through OCR and automate login attempts while rotating IPs to evade rate limits.

Quick Start

Analyze the captcha on this login endpoint and determine whether it can be bypassed logically or solved automatically with OCR.

Frequently Asked Questions about captcha-bypass-methodology

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I bypass image captchas during a penetration test?▼

First attempt logic bypasses: reuse the same code, submit empty or removed captcha parameters, or check if the code is echoed in responses or JavaScript. If those fail, use OCR tools like tesseract or a captcha-solving platform to recognize the characters automatically.

How to automate click-based captcha solving?▼

Parse the prompt text and target coordinates from the captcha response, then simulate clicks at those coordinates using selenium or direct requests. The methodology covers coordinate extraction and replay for click captchas.

What tools recognize captcha images automatically?▼

Tesseract OCR handles simple digit and letter image captchas, while commercial captcha-solving platforms handle distorted or complex images. Slider captchas require gap detection plus simulated drag trajectories to pass frontend trajectory checks.

Can captcha rate limits be bypassed during brute-force testing?▼

Rate limits on captcha send or verify endpoints can be tested via IP rotation, parameter pollution, and concurrent requests. Control request velocity to avoid triggering account lockouts or disrupting the target business.

When is captcha bypass testing not allowed?▼

Captcha bypass testing is only permitted within authorized penetration testing scopes. Brute-force attempts must be rate-controlled to avoid impacting production services, and testing without explicit authorization is prohibited.

Related Skills

Explore More Software Engineering Skills→
elementalsoulselementalsouls
4.0k

hunt-captcha-bypass

Tests web applications for six CAPTCHA bypass patterns including field omission, token replay, and missing server-side validation.

Community
Intermediate
davila7davila7
30.5k

Broken Authentication Testing

Tests web applications for authentication and session management vulnerabilities using structured assessment phases.

Community
Intermediate
salmanabdurrahmansalmanabdurrahman

auth-account-takeover

Validate account takeover vulnerability chains across authentication and recovery workflows.

Community
Advanced
cursorcursor
6.6k

principle-model-the-domain

Encodes domain logic in data structures instead of scattered conditionals across code.

Official
Basic