6

There are multiple reports of a reᴄᴀᴘᴛᴄʜᴀ v2 bypass. Most of the time, the explanation is neural networks services provided by Google or IBM.

But there is something I am failing to understand: for most CAPTCHA(including reCAPTCHA v1) the manually deciphered text is sent directly to the server inside an ʜᴛᴛᴘ header. But with reCAPTCHA v2, the response/ʜᴛᴛᴘ header sent to the server looks like this:

g-recaptcha-response:03AJpayVEtSKNOXg7TJwMkmxzLA_HrnWMKm6p0ox6W6hhMcw3Bzxab8ariLgg8Q8wXpUcF8HLkhAd1ixXgNvBDde5ggVXidl3NuHSQcnP4QqJkVvWZ2s4_CQ1lHTw6oNEqXyiBuS3CkiHBhoB5akijJ6ld115K_OWZo6mfB4xz_-I2P36fVqT9VzEUz26wrauN9QZuC6lh80mf-fkxqCPmNYSOcMrHxR33Flby05gzo5cD1B-2FucaoFP11p2svvZrWC_vAjz5bGOzW0DufM2kkdtLIlhzl9GBzm_chyirSJItHGdz0bMuxDYZkRKY8c4gXUmzT09VEgivi032zZnNXtrVA04gXF5yE0tAtnGTwi31hMdzumPoc6GdLdIbvfbXgdyndocCLIph-j9T8ePf3JO8Jfcf6BNcmUKT2SrhZjIAPUOZV2Mg7Qua_s4zNHYx1-NE8zoe9SG-VxuPbx2sjR32ce4oapa6VA

even with an audio to text sample. Whatever the method claimed to be used, I am still failing to understand the link between g-recaptcha-response HTTP header and human created data.

Recreating the g-recaptcha-response one time token seems to be a requirement for all bypass methods. So what is the link between the one time token and a deciphered audio text for example since peoples did reverse engineered it ?
The only thing I understood is everything is client side concerning token generation (no server side requests).

17
  • They are case where the source code of script is available, but in those case, I am failing to find the token generation algorithm inside the script. Apr 28 '18 at 20:23
  • 3
    Honestly, it is hard to know, as google does not want us to know. Knowing how it works would make it easier to break. I would assume that there is more data in the response, than just the choices themselves. Maybe mouse movement, time it took and similar. You could try to reverse engineer the script, but it would be a pain: gstatic.com/recaptcha/api2/v1524685466525/recaptcha__en.js Apr 28 '18 at 21:05
  • @PeterHarmann what I mean is peoples did reverse engineered it… Obviously. I am failing to understand clear source code of bypass scripts, so I don’t even try with official obfuscated version… At least don’t forget you can upvote. Apr 28 '18 at 21:45
  • @forest Does it not have server side help? I kind of assumed this response is forwarded to google to evaluate. Therefore it could just encode the answers and additional data and evaluate them on googles side. It seems to me to be a bit long for just the answers hashed or otherwise obfuscated. Apr 29 '18 at 10:59
  • @PeterHarmann I suppose I misunderstood.
    – forest
    Apr 29 '18 at 11:00
2

Why reverse engineering the code when you can make it work for you?

It would be sufficient to interact with the rendered web page. For example you could develop a browser extension that waits for the web page to be rendered, downloads the challenge (in this case it was the audio), cracks it (in this case it was slightly obfuscated and sent back to google's own speech recognition engine), inserts the solution in the answer field and finally emulates a mouse click that launches Google's JavaScript to compute the final token.

Source: Bleeping Computer

p.s. Google's ReCAPTCHA is not very privacy friendly, I suggest to use something else.

6
  • 1
    This seems like the obvious answer; I'm not really sure if I get the original question. I mean, why'd they talk about HTML headers and whatnot?
    – Nat
    Jan 27 '19 at 12:36
  • @Nat probably the requester was confused by the fact that the researcher used Python, still it used a Python driver that relied on Firefox for rendering.
    – studio2012
    Jan 27 '19 at 12:48
  • @EnosD'Andrea using browser rendering isn’t efficient. I’m now considering this script as an exception compared to other ones which likely solved the underlining problems through reverse engineering. Jan 27 '19 at 13:05
  • @user2284570 if you use a remote service, the randering time might not be the largest. You might also have to find another way to crack the audio: the original researcher reported that his solution does not work anymore since when Google increased the number of digit and noise of the challenge.
    – studio2012
    Jan 27 '19 at 13:15
  • 1
    @user2284570 I am confident Google's script does not check the integrity of the web page, otherwise it would fail when the page is changed by its author. In your shoes I would try restricting which contents are loaded by the rendering engine and stick to external rendering (possibly remote), otherwise you'd have to start over whenever Google changes implementation details.
    – studio2012
    Jan 27 '19 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.