Tag Info

New answers tagged

0

No, being able to submit an empty form is not a vulnerability. But if this happens due to the lack of front/back-end validation, then the form is vulnerable to many other forms of attacks such as XSS and injection. An empty submission is not much different to a proper submission when it comes to DOS. In a proper submission, you may have additional processing ...


1

Full disclosure: I'm the "inventor" of visualCaptcha. First of all, I love seeing so much people interested and using visualCaptcha. It's been getting a lot of attention and love in the past 6 months. It's amazing to see more and more people using it and interested in improving and "cracking it". I do want everyone to understand the problem visualCaptcha ...


0

In my idea captcha in login page is unnecessary and just bothering users you can use captcha after several attempts you can avoid attacker by using token and as I said captcha after several failing attempt. Use captcha in sign up page and use token in every form that you have in your web site.


2

Yes its neccessary. A token can still be requested by a bruteforcer. Yes, it would cost the bruteforcer one request extra per try, but a captcha still blocks attempts completely instead. If you dont want to bother your users with a captcha, you could set so when a incorrect password is used, the account in question will require a captcha. This both thwarth ...


1

All one would need to do is split the captcha into individual images and perform a Google image search of each image and the target word. And simply pick whichever one has the most results .From that point I am fairly sure that one could get pretty damn high accuracy. You can do a search for "Type below the answer to what you hear" OBJECT where OBJECT ...


3

No - I would't not consider the ability to submit an empty form as a security vulnerability. I can't think of a reason that the ability to submit an empty form would be more vulnerable than the ability to submit a form with valid or even dummy data. It is an indication of a poorly written application - and if I came across this I would suspect that there ...


2

To try it out, I've written a small bot that tries to post the the visual captcha demo. If first initiates the captcha session, telling is only wants 2 options using http://demo.visualcaptcha.net/start/2. Than it picks one of the two possible results and posts to http://demo.visualcaptcha.net/try. Result: ✓☓☓✓✓✓☓☓☓☓☓☓☓✓✓☓☓☓☓☓✓☓✓✓☓✓✓☓✓✓☓✓✓✓✓✓☓✓☓✓✓✓☓✓☓✓☓✓✓✓ ...


5

There are two considerable weaknesses in the live demo which make it quite trivial to break: There are only 5 possible answers to the captcha question, so a bot has a 20% chance to solve the captcha by picking a random symbol. The demo didn't ban me after picking a wrong answer over 20 times in a row, so there is no reason why a bot can't just keep ...


1

To actually answer your question, no, Google does not provide the IP address of the user back to the original website. According to the developer documentation, Google will supply the website with a JSON object basically containing either true or false. { "success": true|false, "error-codes": [...] // optional } But none of this really even matters, ...



Top 50 recent answers are included