Sorry if this is a very amateur question.

I was checking out some article regarding CAPTCHA bypassing. And I though this article seemed interesting http://blog.opensecurityresearch.com/2012/08/bypassing-captchas-by-impersonating.html

Now, captcha clipping

this attack redirects the request from the Server(which is the client for the CAPTCHA provider) to an attacker controlled server.

If I'm using a cURL(or something) to post my request internally this cannot be detected by my Client PC right? So, is it even possible?

1 Answer 1


This can only be done if somehow you intercept the server traffic to the CAPTCHA provider. It can be done by compromising the server itself, its network, or the DNS server it is using. Every method requires the invasion of the server or one of the systems it rely on, you cannot simply detour a server's traffic from your PC home without achieving something like that first.

  • Yes, I was thinking that too. Thank you. Can you explain a little bit more how the python script(in the above article) is working then? Is it like first gain privilege of that server and then run the script IN that server? Commented Mar 18, 2014 at 19:57
  • I'm not sure how its supposed to be used but aparently it mimics the HTTP server of a CAPTCHA provider, so if you detour a server's attempt to connect to ReCAPTCHA for instance and make it connect to the server clipcaptcha created instead, it will do the rest of the work of making the server believe its legitimate and provide attacker-controlled CAPTCHA challenges.
    – Havenard
    Commented Mar 18, 2014 at 22:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .