+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.ly/Forum-Website-Server-Hacking)
+--- Thread: Bypassing Captchas - In Theory (/Thread-Bypassing-Captchas-In-Theory)
Pages:
1
2
Bypassing Captchas - In Theory - Ominous - 10-12-2013
I heard of this spamming program called Xrumer which has the ability to bypass multiple types of captchas by some weird-ass algorithm (not OCR).
Can anyone break this down and (maybe) explain how exactly this works?
RE: Bypassing Captchas - In Theory - Oni - 10-12-2013
Ironic, because I finished a forum registration program a while back for MyBB. Now I just need to make it for spamming.
RE: Bypassing Captchas - In Theory - Ominous - 10-12-2013
(10-12-2013, 08:35 PM)Oni Wrote: Ironic, because I finished a forum registration program a while back for MyBB. Now I just need to make it for spamming.
Does it bypass the default MyBB captcha and those spambot questions?
And what language is it coded in? Pls be PHP
RE: Bypassing Captchas - In Theory - w00t - 10-13-2013
Probably just predicts it, or has a massive DB of IDs and their associated letters.
RE: Bypassing Captchas - In Theory - Customer - 10-13-2013
I would love a way to bypass captchas.
It would save me 20.
RE: Bypassing Captchas - In Theory - Cressi - 10-13-2013
There are cases they really are needed (http://tinyurl.com/qhx2spm).
RE: Bypassing Captchas - In Theory - Ominous - 10-13-2013
(10-13-2013, 10:01 AM)cressi97 Wrote: There are cases they really are needed (http://tinyurl.com/qhx2spm).
How I wish there was a facepalm smiley installed right now.
Bypassing Captchas - In Theory - Adorapuff - 10-13-2013
You could use a image to text API which theoretically will display what is written in plaintext.
RE: Bypassing Captchas - In Theory - Ominous - 10-13-2013
Just found out, Xrumer uses a complicated algorithm OCR thingy called averaging, which reduces distortion and noise in the CAPTCHA image, then simply uses a basic OCR algorithm to decode. Says it takes less than 1.5 seconds on average. O_o
RE: Bypassing Captchas - In Theory - Reiko - 10-14-2013
There's a trick with certain CAPTCHA implementations that's similar to a replay attack. Save a PHPSESSID cookie and a solved CAPTCHA and some software will let you resubmit these, but only if they create a new session for each CAPTCHA and don't destroy them.
Example: older versions of the Kusaba X imageboard
It's not the only thing vulnerable to this trick.
(10-13-2013, 09:23 PM)Ominous Wrote: Just found out, Xrumer uses a complicated algorithm OCR thingy called averaging, which reduces distortion and noise in the CAPTCHA image, then simply uses a basic OCR algorithm to decode. Says it takes less than 1.5 seconds on average. O_o
This only works to a certain extent. CAPTCHA technology evolves specifically to defeat OCR, which is why you see distortions and real-world images (in ReCAPTCHA's case) being used now. Google actually heads up their own OCR as well as the reCAPTCHA system. They're (unofficially) at constant war with themselves for the greater good.
Check it out at https://code.google.com/p/tesseract-ocr/
Can we change this thread's name from "In Theory" to "In Practice" now?
Thanks.
(10-12-2013, 08:37 PM)Ominous Wrote: Does it bypass the default MyBB captcha and those spambot questions?The "spambot questions" or "textCHAs" are a little weird, but with a program capable of processing natural language, most of them aren't actually difficult. It's just something we're not used to yet.
And what language is it coded in? Pls be PHP