6

There are multiple reports of a reᴄᴀᴘᴛᴄʜᴀ v2 bypass. Most of the time, the explanation is neural networks services provided by Google or IBM.

But there is something I am failing to understand: for most CAPTCHA(including reCAPTCHA v1) the manually deciphered text is sent directly to the server inside an ʜᴛᴛᴘ header. But with reCAPTCHA v2, the response/ʜᴛᴛᴘ header sent to the server looks like this:

g-recaptcha-response:03AJpayVEtSKNOXg7TJwMkmxzLA_HrnWMKm6p0ox6W6hhMcw3Bzxab8ariLgg8Q8wXpUcF8HLkhAd1ixXgNvBDde5ggVXidl3NuHSQcnP4QqJkVvWZ2s4_CQ1lHTw6oNEqXyiBuS3CkiHBhoB5akijJ6ld115K_OWZo6mfB4xz_-I2P36fVqT9VzEUz26wrauN9QZuC6lh80mf-fkxqCPmNYSOcMrHxR33Flby05gzo5cD1B-2FucaoFP11p2svvZrWC_vAjz5bGOzW0DufM2kkdtLIlhzl9GBzm_chyirSJItHGdz0bMuxDYZkRKY8c4gXUmzT09VEgivi032zZnNXtrVA04gXF5yE0tAtnGTwi31hMdzumPoc6GdLdIbvfbXgdyndocCLIph-j9T8ePf3JO8Jfcf6BNcmUKT2SrhZjIAPUOZV2Mg7Qua_s4zNHYx1-NE8zoe9SG-VxuPbx2sjR32ce4oapa6VA

even with an audio to text sample. Whatever the method claimed to be used, I am still failing to understand the link between g-recaptcha-response HTTP header and human created data.

Recreating the g-recaptcha-response one time token seems to be a requirement for all bypass methods. So what is the link between the one time token and a deciphered audio text for example since peoples did reverse engineered it ?
The only thing I understood is everything is client side concerning token generation (no server side requests).

  • They are case where the source code of script is available, but in those case, I am failing to find the token generation algorithm inside the script. – user2284570 Apr 28 '18 at 20:23
  • 3
    Honestly, it is hard to know, as google does not want us to know. Knowing how it works would make it easier to break. I would assume that there is more data in the response, than just the choices themselves. Maybe mouse movement, time it took and similar. You could try to reverse engineer the script, but it would be a pain: gstatic.com/recaptcha/api2/v1524685466525/recaptcha__en.js – Peter Harmann Apr 28 '18 at 21:05
  • @PeterHarmann what I mean is peoples did reverse engineered it… Obviously. I am failing to understand clear source code of bypass scripts, so I don’t even try with official obfuscated version… At least don’t forget you can upvote. – user2284570 Apr 28 '18 at 21:45
  • @forest Does it not have server side help? I kind of assumed this response is forwarded to google to evaluate. Therefore it could just encode the answers and additional data and evaluate them on googles side. It seems to me to be a bit long for just the answers hashed or otherwise obfuscated. – Peter Harmann Apr 29 '18 at 10:59
  • @PeterHarmann I suppose I misunderstood. – forest Apr 29 '18 at 11:00
1

Why reverse engineering the code when you can make it work for you?

It would be sufficient to interact with the rendered web page. For example you could develop a browser extension that waits for the web page to be rendered, downloads the challenge (in this case it was the audio), cracks it (in this case it was slightly obfuscated and sent back to google's own speech recognition engine), inserts the solution in the answer field and finally emulates a mouse click that launches Google's JavaScript to compute the final token.

Source: Bleeping Computer

p.s. Google's ReCAPTCHA is not very privacy friendly, I suggest to use something else.

  • 1
    This seems like the obvious answer; I'm not really sure if I get the original question. I mean, why'd they talk about HTML headers and whatnot? – Nat Jan 27 at 12:36
  • @Nat probably the requester was confused by the fact that the researcher used Python, still it used a Python driver that relied on Firefox for rendering. – Enos D'Andrea Jan 27 at 12:48
  • @EnosD'Andrea using browser rendering isn’t efficient. I’m now considering this script as an exception compared to other ones which likely solved the underlining problems through reverse engineering. – user2284570 Jan 27 at 13:05
  • @user2284570 if you use a remote service, the randering time might not be the largest. You might also have to find another way to crack the audio: the original researcher reported that his solution does not work anymore since when Google increased the number of digit and noise of the challenge. – Enos D'Andrea Jan 27 at 13:15
  • @EnosD'Andrea Not with high latency connections : you download many non required things in this technic (takes 20 to 30s in my place whereas a captcha is downloaded in 1s or less). In fact I asked this question in order to find a way to bypass recognizing requirement even with bot handling. – user2284570 Jan 27 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.