hunt-captcha-bypass
帮助渗透测试者快速定位高频 CAPTCHA 缺陷
可被滥用于绕过验证码进行非法访问，需合法授权
自动化检测常见 CAPTCHA 绕过缺陷并提供测试方法
▸ 展开 SKILL.md 英文原文
Hunt CAPTCHA Bypass — 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation absent), (2) CAPTCHA token replayed from a solved challenge (no single-use enforcement), (3) CAPTCHA response accepted on a different endpoint than it was solved on (no binding to action/session), (4) static or predictable CAPTCHA values accepted (e.g. '0', 'null', empty string), (5) audio/accessibility CAPTCHA trivially solvable programmatically, (6) CAPTCHA only enforced after N failures (first N requests bypass it). Detection: intercept a successful form submission, remove the CAPTCHA field entirely, replay — if it still succeeds, server-side validation is absent. Medium severity standalone; High when it removes the only rate-limit gate protecting a login, registration, or payment endpoint.
帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-captcha-bypass/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-captcha-bypass/SKILL.md"## Autonomous Testing Priority **The fastest test: just omit the CAPTCHA field entirely. Most CAPTCHA bypass bugs are client-side-only validation.** **Pattern 1 — Omit the CAPTCHA field (most common, most automatable):** 1. GET the form/endpoint that shows a CAPTCHA to understand its field name (usually `g-recaptcha-response`, `captcha`, `captcha_token`, `captcha_answer`, `h-captcha-response`) 2. POST the form with ALL fields EXCEPT the CAPTCHA field 3. If the action succeeds (200, redirect, or "success" message) → no server-side CAPTCHA validation 4. Proof: the state-changing action completes without a valid CAPTCHA field (compare against a baseline request that includes it) **Pattern 2