skills.rest
elementalsouls
elementalsoulsCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-captcha-bypass

Tests web applications for six CAPTCHA bypass patterns including field omission, token replay, and missing server-side validation.

4.0k|628|Updated May 5, 2026
Search Tags:#security testing#web security#bug bounty#recaptcha#token replay#CAPTCHA bypass#Rate limiting
One-click install
npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-captcha-bypass
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-captcha-bypass
Source: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-captcha-bypass
Command: npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-captcha-bypass

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CAPTCHA controls often look enforced but fail server-side, leaving login, registration, and password-reset endpoints open to automation, brute force, and account farming. This Skill gives security testers a structured checklist to verify whether CAPTCHA validation actually exists and holds up under replay, omission, and cross-endpoint abuse.

Core Features & Use Cases

  • Six Bypass Patterns: Covers omitted CAPTCHA fields, empty/null values, replayed tokens, unprotected sibling endpoints, rate-window challenges, and static or predictable CAPTCHAs.
  • Concurrency Guidance: Explains how to fire parallel requests to satisfy sliding-window rate counters that sequential testing cannot trigger.
  • Impact Chaining: Maps findings to severity by chaining with brute force, forgot-password, and race-condition attack paths.
  • Use Case: During an authorized bug bounty engagement, intercept a registration request, remove the g-recaptcha-response field, and replay it — if account creation succeeds, you have confirmed missing server-side CAPTCHA validation with a reproducible proof.

Quick Start

Ask the AI to test the target's registration and login forms for CAPTCHA bypass by omitting the CAPTCHA field and replaying a solved token.

Frequently Asked Questions about hunt-captcha-bypass

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for CAPTCHA bypass on a login or registration form?▼

Intercept a successful form submission, remove the CAPTCHA field entirely (e.g. g-recaptcha-response), and replay the request. If the action still succeeds, server-side validation is absent. Also try empty, null, or 0 as the field value.

What are the most common CAPTCHA bypass techniques?▼

The most common techniques are omitting the CAPTCHA field, submitting empty or static values, replaying a previously solved token, and hitting equivalent API endpoints that lack CAPTCHA enforcement. Some apps also only enforce CAPTCHA after N failed attempts.

Can a solved reCAPTCHA token be reused for multiple requests?▼

Yes, if the server does not enforce single-use consumption of the token. Solve one challenge legitimately, capture the token, and submit it again with a second request — success confirms a replay vulnerability.

Why does sequential testing fail against rate-based CAPTCHA triggers?▼

Sliding-window counters require N requests within a short time window, which sequential requests cannot satisfy. Fire requests concurrently so they arrive simultaneously and trip the counting middleware.

What severity is a CAPTCHA bypass vulnerability?▼

Standalone CAPTCHA bypass is typically Medium severity since it enables automation of rate-limited actions. It escalates to High or Critical when it removes the only gate protecting login brute force, account farming, or password-reset flooding.

Related Skills

Explore More Software Engineering Skills→
dougwithseismicdougwithseismic

mitm-start

Start the MITM proxy in headless mode and export HTTP/HTTPS proxy environment variables.

Community
Basic
Prohao42Prohao42
120

authbypass-authentication-flaws

Identify and bypass authentication flaws in web applications.

Community
Advanced
bpnrockstarbpnrockstar

hunt-brute-force

Detect missing rate limiting and brute force enumeration vulnerabilities in web applications.

Community
Advanced
raindrop-airaindrop-ai
961

raindrop-add-readonly-replay

Adds per-run readonly mode to replay production traces safely via HTTP /replay endpoint.

Official
Advanced