hunt-captcha-bypass

Intercept a successful form submission, remove the CAPTCHA field entirely (such as g-recaptcha-response), and replay the request. If the action still succeeds, the server lacks CAPTCHA validation. Also try empty, null, or replayed token values.

The most common technique is omitting the CAPTCHA field from the request, since many apps only validate client-side. Other patterns include replaying solved tokens, submitting empty values, and using endpoints like API paths that lack CAPTCHA enforcement.

reCAPTCHA tokens are intended to be single-use, but some servers fail to revoke them after verification. Capture a solved token and submit it in a second request; if it succeeds again, the token is replayable and can be shared across automated requests.

Sliding-window counters require N requests within a short time window, which sequential pacing cannot satisfy. Fire requests concurrently so they arrive simultaneously and trip the counting middleware, ensuring payloads are well-formed enough to reach the counter.

CAPTCHA bypass alone is typically Medium severity since it enables automation of rate-limited actions. It escalates to High or Critical when it removes the only rate-limit gate protecting login, registration, or payment endpoints, enabling brute force or account farming.