3

In reCAPTCHA's API (without plugin), the key part is 

<iframe src="http://www.google.com/recaptcha/api/noscript?k=your_public_key"
     height="300" width="500" frameborder="0"></iframe><br>
 <textarea name="recaptcha_challenge_field" rows="3" cols="40">
 </textarea>
 <input type="hidden" name="recaptcha_response_field"
     value="manual_challenge">

The website embedding this API actually asks the user to retrieve a iframe from reCAPTCHA using a public key. Suppose stackexchange is using reCAPTCHA and it has a public key A. And I want to attack stackexchange by circumventing its CAPTCHA.

Suppose I have a website that has some legitimate users. I can embed a reCAPTCHA API in my website that using public key A, which is stackexchange's reCAPTCHA public key. Now after the users of mine solve the CAPTCHA, they will submit a CAPTCHA challenge id and solution to my website. After that, I can submit the same challenge id and solution to stackexchange using a automated script. Then I successfully bypass the CAPTCHA challenge of stackexchange.

I am not sure whether this attack is practical or not. Suppose the browser of my users do not fill the HTTP referrer field in the request to reCAPTCHA, which prevents reCAPTCHA knowing that my website is actually using stackexchange's public key.

Improve this question
1
  • The purpose of a CAPTCHA is to filter out robots. Even if what you did work, you are still using humans to solve the CAPTCHA. What is your objective and how does this count as a phishing attack?
    – Question Overflow
    Commented Oct 4, 2014 at 3:23

1 Answer 1

Reset to default
0

It seems that no one is going to answer this question.

According to my experiment, Google uses HTTP referer to limit the usage of reCAPTCHA public. When register a new reCAPTCHA account, Google will ask you to type in the site (domain) where you will use the reCAPTCHA public key. Then when a user visits your website and is sending request to reCAPTCHA to retrieve the CAPTCHA image, his browser will put the domain of the website he is visiting into the HTTP referer field. Then reCAPTCHA will know whether the domain of the website that is using the public key is the same to the domain which owns the public key. If not, reCAPTCHA will issue a warning in the browser.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .