Skip to main content

Questions tagged [captcha]

Completely Automated Public Turing test to tell Computers and Humans Apart used in form validation to restrict access to humans only

Filter by
Sorted by
Tagged with
0 votes
1 answer
48 views

Where to host custom catch-page Cloudflare?

Cloudflare offers the option to show your own custom catchpa-validation page instead of the standard page with the Cloudflare logo. You do this by making a HTML file with the ::CATCHPA_BOX:: ...
O'Niel's user avatar
  • 2,916
0 votes
0 answers
49 views

WAF vs. Application Layer for Bot Mitigation

In a layered enterprise security architecture with a Web Application Firewall (WAF) deployed in the DMZ, should there be shared responsibility between the WAF and application layer/ microservices for ...
Fahim Farook's user avatar
1 vote
0 answers
43 views

Am I supposed to granularly configure recaptcha in all places of a webapp?

I am trying to understand how to properly configure things like Google RecaptchaV3. I have configured it manually for just one of tens of the views in my webapp so it sends a token to backend and ...
Sergei Basharov's user avatar
1 vote
0 answers
106 views

Why does Amazon make you enter specified digits upon calling their customer service switchboard?

If one calls the Amazon customer services number, a robotic voice asks one to enter three numbers. Along the lines of “to be connected to a customer service associate, please press [XYZ]” (where [xyz] ...
TylerDurden's user avatar
1 vote
0 answers
365 views

What is the purpose of the temu captchas?

When shopping on temu, while logged in to an account for which temu has a credit card and physical address and browsing normally, I am presented by an slider CAPTCHA frequently enough that it is ...
User65535's user avatar
  • 279
2 votes
0 answers
674 views

Automated bot/spammer bypassing google recaptcha v2

I have a Laravel registration form with the invisible google recaptcha v2 installed with the security set to highest level within the recaptcha admin console - code as follows: <div> <div ...
adam78's user avatar
  • 121
-3 votes
1 answer
241 views

Can reCaptcha be hacked?

ReCaptcha seems to be used even by google, and so I believe it works (at least most of the time). So how has nobody managed to hack it? I mean, they could just look into reCaptcha code to find the ...
Zitian Yang's user avatar
0 votes
1 answer
243 views

Has my network been captcha blacklisted

I usually visit a particular site and I never get captchas there. Recently, I wrote a web crawler to visit that site and do things for me. I used the crawler a lot and now I get captchas on the site. ...
Noble Eugene's user avatar
1 vote
1 answer
224 views

What are risks to users if pages do not have reCAPTCHA?

I understand how reCAPTCHA mitigates risk for site owners but how does reCAPTCHA benefit users? With hackers exploiting fake reCAPTCHA to trick users into clicking and/or entering secure information ...
Jen Dietrch's user avatar
0 votes
1 answer
2k views

Is CAPTCHA even relevant for mobile apps?

How important is it to humanize the mobile-app registration process in order to prevent bot registrations? I was under the impression that CAPTCHA, probably the leading technology in this space, was ...
lurning too koad's user avatar
0 votes
0 answers
143 views

Is ReCAPTCHA v3 is safe for my site? [closed]

Do you recommend using Google Recaptcha V3 or using Custom Captcha(like enter a number)? Some people say that Google Recaptcha V3 causes problems for the site, such as error (Creating insecurity on ...
user avatar
2 votes
2 answers
856 views

CAPTCHA w/o Server-Side Persistence

I would like to implement my own CAPTCHA challenge for a website. The framework I use implements client-side session cookies, which are not encrypted, only signed with server's private key. The ...
cryptoanarchy's user avatar
1 vote
0 answers
308 views

what vulnerability does 'pypasser' exploit? [closed]

The project pypasser claims to bypass "vulnerable" reCaptcha v3 sites. What vulnerability?
user19087's user avatar
  • 111
1 vote
0 answers
313 views

What is the point of client-side captcha verification?

I have seen dozens of client-side captcha verification on github and considering it is just a matter of time to make it totally useless, what are the purposes of these? Are there any justifications ...
Le Chat Noir's user avatar
1 vote
2 answers
416 views

Is there any way to guarantee real user registration?

I would like to provide some free tokens to users on registration, I don't want bot accounts to register and get free tokens. Is there any way to prevent this? I would like to use phone verification, ...
Shravan S's user avatar
3 votes
3 answers
558 views

Is using PBKDF2 good protection against brute-force attacks on web application login pages?

We've recently had a penetration test for one of our applications. The Penetration Testing company identified that our application lacks protections against brute-force attacks on the login page. Ref: ...
Silvercroft's user avatar
0 votes
2 answers
263 views

Are 3rd party CAPTCHA techniques vulnerable to MITM attacks?

Presume I'm a bad actor and want to do a naughty thing on a site protected by some 3rd party CAPTCHA solution. For instance, perhaps I'm a spammer who wants some way to script sign-ups to Hotmail. For ...
Tom Wright's user avatar
4 votes
2 answers
225 views

How do we verify a human agent in light of WCAG 2.2?

WCAG is a set of standard web accessibility criteria developed by the W3C that have been adopted by regulatory agencies in a number of countries, including Section 508 in the U.S., which makes ...
OpenAI was the last straw's user avatar
0 votes
1 answer
11k views

how can I bypass recaptcha while using python requests? [closed]

How can I bypass the recaptcha on a website with python requests so that I don't have to solve it?
mohamed elgamal's user avatar
1 vote
1 answer
870 views

What happens when captcha keys get compromised? [duplicate]

I was just wondering out of interest. What happens if your captcha keys get compromised. What can they be used for and how can you detect that they have been compromised.
bluejay's user avatar
  • 13
1 vote
0 answers
152 views

How are accountgenerators with captchas still possible?

I was asking myself, how there are still account generators (e.g. for Steam) wide available for everyone. With account generators I mean programs, that are automatically creating a huge amount of ...
Rechtsgewinde's user avatar
-1 votes
1 answer
2k views

CAPTCHA with Burpsuite or AppScan

I have an web application which uses login user password and captcha for login. Is there a way to perform vulnerability assessment using AppScan or Burpsuite tools to capture the CAPTCHA automatically ...
AppSecGuy's user avatar
3 votes
3 answers
350 views

How can I stop fraudulent credit card submissions on a donation site?

We are a small nonprofit that accepts donations online. Our site is being hammered by hundreds of fraudulent credit card submissions per day, coming from multiple IP's all over the world (a ...
Ben Davis's user avatar
  • 224
0 votes
1 answer
329 views

How does Cloudflare firewall work?

How does Cloudflare web firewall work? When someone tries to enter a website, they first go through the Cloudflare server and then, if a captcha is solved, they can see the content of the website. So ...
Emmanuel-Ab's user avatar
3 votes
2 answers
247 views

Do we use different CAPTCHAs with different difficulty to how sensitive the request is?

My idea is to use a sort of layered CAPTCHA model (4 layers - from which layer 0 is no captcha) with difficulty as primary focus. My first focus beside stopping bots is to make the visitor more and ...
CriticalSYS's user avatar
3 votes
1 answer
2k views

Can we prevent DDoS or spam form submission with client authentication?

There is a public query form in my web app, and architecture team asking to authenticate the web app with OAuth2 like this, but I don't believe it will be of any help. I believe best way to protect ...
smali's user avatar
  • 153
-1 votes
2 answers
559 views

How secure is a 4 digit numbers only captcha? [closed]

How secure is a 4 digit numbers only captcha? How many tries will take to be able to bruteforce that captcha?
Pong's user avatar
  • 81
-1 votes
1 answer
1k views

How is this allowing me to bypass recaptcha [closed]

I was testing rate limit on the login page of a site. It was captcha protected. I could not even intercept the POST request on burp, so from Google Chrome I looked at the logs and in its POST request, ...
Ali Azan's user avatar
1 vote
1 answer
376 views

What alternatives do we have for Google's reCaptcha? [closed]

reCaptcha has been getting some criticism over that it's tracking visitor data recently. What are the best solutions available? Is there one that has better privacy for visitors?
Andy Jacksson's user avatar
12 votes
2 answers
19k views

Should I use ReCAPTCHA v2 or v3?

I've seen lots of SO posts and other articles on the internet about the differences between Google's ReCAPTCHA v2 and v3, but I'm not sure which one I should use. I'm looking to protect my website's ...
APixel Visuals's user avatar
0 votes
1 answer
563 views

Captcha against Mitm attacks works?

I was pentesting a website that didn't have any security against MITM attacks and discovered that when I was trying to steal the log in credentials attacking myself that the CAPTCHA couldn't connect ...
Tomi Begher's user avatar
2 votes
2 answers
681 views

How can google's ReCaptcha verify identity *and* train AI?

I have heard that the reason the image portion of ReCaptcha contains so many driving questions is that Google is using it to train AI for their self-driving cars. But to make it an effective security ...
CompileYourCake's user avatar
1 vote
1 answer
3k views

How Recaptcha Detect Fake User-Agent

I'm trying to understand how can recaptcha__en.js detect fake User-Agent, for the test you can try the demo here with addon User-Agent switcher installed, for logged in user it will get score 0.9 no ...
uingtea's user avatar
  • 111
1 vote
2 answers
571 views

Securimage php library for Captcha Code showing security issues in Arachni Scanner

I have used the securimage PHP library to show a captcha on my form. But when I'm scanning my page for vulnerabilities using Arachni scanner, it shows the following message and it's trying to scan the ...
Abdul Rahman's user avatar
2 votes
1 answer
718 views

Can we use reverse image search to bypass image CAPTCHAs?

Has there been any group that managed to bypass the Image CAPTCHAs using reverse image search? Whats stopping people from writing a script that bypasses these CAPTCHAs by reverse image searching via ...
Richard Jones's user avatar
38 votes
8 answers
17k views

Is brute force a probable threat even if you enable CAPTCHA and rate limit logins?

Let's assume CAPTCHA is enabled with account lock out control (after five continuous failed attempts, the account will be locked for 15 min) on a system. Is brute force still a probable threat?
Sayan's user avatar
  • 2,031
5 votes
3 answers
367 views

What benefit do Captchas provide?

I have researched and found the following sites which will break captchas: anticaptcha 2captcha (links not included to prevent promoting the sites) Given that these services can be used to break ...
Alex's user avatar
  • 527
7 votes
2 answers
5k views

By using reCAPTCHA which information is Google collecting?

Wanting to avoid bots registering on a website, I might use reCAPTCHA by Google. Since the algorithm behind reCAPTCHA is not open source, I'm wondering what user information they actually collect ...
Raka's user avatar
  • 79
1 vote
1 answer
209 views

How efficient are the old-good text-image-based capthas nowdays to prove that a form has been submited by a human?

With the rise of google re-Captcha that is known to be the most effective one because of the use of real images that are computational hard to get distinguished from a machine. In other words a human ...
Dimitrios Desyllas's user avatar
0 votes
0 answers
916 views

Why does Google's "identify a thing" captcha include a long waiting time between showing images?

One of Google's "Recaptcha" challenges asks users to identify a "thing" (typically a car or something similar) in a set of different small photos on a 3x3 grid: After clicking one of the "things", ...
Nijin22's user avatar
  • 142
-2 votes
1 answer
236 views

Why do websites like Truecaller make you prove that you are not a robot after a limited number of searches?

I used Truecaller for searching for a number but after around 20 to 25 searches they started asking me to prove that I am not a robot. Is this for protecting their website from a DDoS attacks or is it ...
genral Hummel's user avatar
6 votes
1 answer
2k views

How was Google recaptcha v2 bypassed several times?

There are multiple reports of a reᴄᴀᴘᴛᴄʜᴀ v2 bypass. Most of the time, the explanation is neural networks services provided by Google or IBM. But there is something I am failing to understand: for ...
user2284570's user avatar
  • 1,482
1 vote
3 answers
758 views

How can I protect the signup form in my website? Is special spam prevention needed?

I'm struggling to write a secure sign-up form for my website. (My site is some kind of an image gallery. I have knowledge in html, javascript, msql and php) I know there is a tactic to secure login ...
Catso's user avatar
  • 13
4 votes
1 answer
255 views

Is there a security benefit to requiring a login before and after a captcha test?

On Stack Exchange, if you login with your email address and password and then get captcha tested, you have to provide your credentials a second time after passing the captcha. I've been trying to ...
Jon Bentley's user avatar
  • 2,061
0 votes
1 answer
589 views

How to securely collect email addresses through a third party website

I would like to collect email addresses through a third party website and subscribe them to a Sendgrid mailing list. Flow: User goes to a website hosted by unbounce.com that uses my website's ...
Chris Hansen's user avatar
3 votes
1 answer
1k views

Should users need to complete a CAPTCHA upon changing their password in their account settings?

On Last.fm, I need to complete a CAPTCHA in order to change my password. I want to change my password because haveibeenpwned lists my account as appearing in the last.fm breach. However, the CAPTCHA ...
Luc's user avatar
  • 33k
10 votes
1 answer
3k views

Can CAPTCHA-solving patterns be used to track/identify a person?

Captchas are everywhere. Suppose you're a big company offering Captchas on many sites and you can easily track a user across the web simply by setting a cookie everytime some site loads your captcha ...
dervonnebenaan's user avatar
6 votes
4 answers
646 views

Are logins with button pushes more secure than normal form logins?

I recently moved to France and had to find a new cell provider, and I settled on Free Mobile. Their login page features a button-push login for the 'identifiant' (username), and a normal form field ...
Chris Cirefice's user avatar
1 vote
1 answer
238 views

Might have been infected

I recently got redirected to a site which just made a loud beeping sound, when trying to just access a link in a YouTube video discription. My Anti Virus Program (Kaspersky Internet Security) ...
Jan1902's user avatar
  • 11
2 votes
1 answer
180 views

Is sending recaptchaPublicKey & RecaptchaToken in the post request a potential security threat?

I have implemented reCaptcha in login form to slow down the potential brute force attack. However, the application sends recaptchaPublicKey & RecaptchaToken in the post request along with the ...
NinjaV's user avatar
  • 21