[Ominous]

I heard of this spamming program called Xrumer which has the ability to bypass multiple types of captchas by some weird-ass algorithm (not OCR).

Can anyone break this down and (maybe) explain how exactly this works?

[Oni]

Ironic, because I finished a forum registration program a while back for MyBB. Now I just need to make it for spamming.

[Ominous]

Ironic, because I finished a forum registration program a while back for MyBB. Now I just need to make it for spamming.

Does it bypass the default MyBB captcha and those spambot questions?

And what language is it coded in? Pls be PHP

[w00t]

Probably just predicts it, or has a massive DB of IDs and their associated letters.

[Customer]

I would love a way to bypass captchas.

It would save me 20.

[Cressi]

There are cases they really are needed (http://tinyurl.com/qhx2spm).

[Ominous]

There are cases they really are needed (http://tinyurl.com/qhx2spm).

How I wish there was a facepalm smiley installed right now.

[Adorapuff]

You could use a image to text API which theoretically will display what is written in plaintext.

[Ominous]

Just found out, Xrumer uses a complicated algorithm OCR thingy called averaging, which reduces distortion and noise in the CAPTCHA image, then simply uses a basic OCR algorithm to decode. Says it takes less than 1.5 seconds on average. O_o

[Reiko]

There's a trick with certain CAPTCHA implementations that's similar to a replay attack. Save a PHPSESSID cookie and a solved CAPTCHA and some software will let you resubmit these, but only if they create a new session for each CAPTCHA and don't destroy them.

Example: older versions of the Kusaba X imageboard
It's not the only thing vulnerable to this trick.

---

Just found out, Xrumer uses a complicated algorithm OCR thingy called averaging, which reduces distortion and noise in the CAPTCHA image, then simply uses a basic OCR algorithm to decode. Says it takes less than 1.5 seconds on average. O_o

This only works to a certain extent. CAPTCHA technology evolves specifically to defeat OCR, which is why you see distortions and real-world images (in ReCAPTCHA's case) being used now. Google actually heads up their own OCR as well as the reCAPTCHA system. They're (unofficially) at constant war with themselves for the greater good.
Check it out at https://code.google.com/p/tesseract-ocr/


Can we change this thread's name from "In Theory" to "In Practice" now?
Thanks.

---

Does it bypass the default MyBB captcha and those spambot questions?

And what language is it coded in? Pls be PHP

The "spambot questions" or "textCHAs" are a little weird, but with a program capable of processing natural language, most of them aren't actually difficult. It's just something we're not used to yet.