hunt-captcha-bypass

> **⚠️ AUTHORIZED USE ONLY**

> This skill is for educational purposes or authorized security assessments only.

> You must have explicit, written permission from the system owner before using this tool.

> Misuse of this tool is illegal and strictly prohibited.

> **Mandatory confirmation gate**

> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

> 1. Ask the user to state the exact target URL, IP, account, or resource.

> 2. Ask the user to confirm written authorization and the permitted scope.

> 3. Show the exact command(s) and explain their expected effect.

> 4. Wait for explicit confirmation in the current conversation.

>

> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

Autonomous Testing Priority

**The fastest test: just omit the CAPTCHA field entirely. Most CAPTCHA bypass bugs are client-side-only validation.**

**Pattern 1 — Omit the CAPTCHA field (most common, most automatable):**

1. GET the form/endpoint that shows a CAPTCHA to understand its field name (usually `g-recaptcha-response`, `captcha`, `captcha_token`, `captcha_answer`, `h-captcha-response`)

2. POST the form with ALL fields EXCEPT the CAPTCHA field

3. If the action succeeds (200, redirect, or "success" message) → no server-side CAPTCHA validation

4. Proof: the state-changing action completes without a valid CAPTCHA field (compare against a baseline request that includes it)

**Pattern 2 — Empty or null CAPTCHA value:**

Instead of omitting the field entirely, include it with an empty string, `null`, `0`, or `undefined`:

captcha=&email=test@example.com&password=test123

Some apps validate field presence but not content.

**Pattern 3 — Replay a previously solved CAPTCHA token:**

1. Complete one legitimate CAPTCHA challenge and capture the `g-recaptcha-response` token

2. Submit a second request immediately with the SAME token value

3. If the second submission also succeeds → token is not single-use (replay attack)

4. A replayed token can be shared across automated requests

**Pattern 4 — Test without CAPTCHA on similar endpoints:**

Some apps add CAPTCHA to the registration form but forget the password reset, API endpoint, or mobile API path (`/api/register` vs `/register`). Try the same action via the API path without any CAPTCHA field.

**Pattern 5 — Rate/throughput-gated "prove you're automated" challenges:**

Some apps define CAPTCHA "bypass" as simply exceeding the rate a human could plausibly sustain —

e.g. "N submissions within T seconds" — checked by a middleware that counts REQUESTS REACHING the

route, not successful outcomes. Garbage/placeholder payloads satisfy this exactly as well as valid

ones, since the counter increments regardless of whether the request's own validation passes.

**Timing note (sliding-window counters):** don't solve this one request at a time — a sequential

pace (seconds between each request) structurally cannot land N requests inside a short sliding

window, and issuing more requests serially does not fix it. A typical failing pattern is 12

requests spread across ~250 seconds when the check requires ~10 requests within 20 seconds.

Instead fire the requests **concurrently** (e.g. `"concurrency": N` on a single request call, or

any parallel-request primitive your tooling offers, with N >= the required count) so they arrive

simultaneously and satisfy the sliding window trivially. Check the endpoint's own

required-field validation first (e.g. a `rating` field that can't be null) so the concurrent

payload is at least well-formed enough to reach the counting middleware, even if other fields

(like the CAPTCHA answer itself) are wrong or reused.

**What to skip in automated testing:** Solving real reCAPTCHA/hCaptcha programmatically (OCR, audio bypass) requires external services. Only attempt if patterns 1-4 fail and the test budget allows.

**Proof:** Any