Captcha Bypass

1. Captcha ?: -
1. Arithmetic , visual, image.
2. It is not authentication control but it mitigates enumeration of attacks.
3. Analyse the login form behavior, Enter the wrong username/password and correct captcha.
4. Replay Attack - Intercept the request in burp and send this request to repeater and intruder.
5. In repeater check the captcha is getting expired or not? If not then go ahead with attack.
6. Drop the request from burp intercepter.
7. In intruder add the parameter , username and password.
8. Use cluster bomb attack type. It will use both parameters in single request/attack.
9. Fill the payloads options with wordlist of usernames and passwords.
10. Grep match in options, put the invalid password message string.
11. Check the reponses.