A guessable CAPTCHA is a human-verification challenge that can be solved or bypassed by automated tools, defeating its core purpose. When a CAPTCHA is too…
A guessable CAPTCHA is a human-verification challenge that can be solved or bypassed by automated tools, defeating its core purpose. When a CAPTCHA is too simple, predictable, or poorly implemented, attackers can automate account creation, credential stuffing, spam submission, or other abuse at scale. This weakness directly undermines the security control meant to prevent such attacks.
CAPTCHAs fail when they rely on weak or predictable mechanisms: simple math problems with obvious answers, image recognition tasks using common objects, text that is too large or clear to OCR-resist, or challenges that don't change between requests. Some implementations store the correct answer in client-side code, cookies, or session variables in a way that can be read or manipulated. Others use static challenges, reuse the same challenge across multiple requests, or employ algorithms that are reverse-engineerable. The fundamental flaw is treating the CAPTCHA as a security control while implementing it with insufficient entropy, obfuscation, or validation.
Weak CAPTCHAs enable large-scale automated abuse: attackers can create thousands of fake accounts, submit spam or malicious content in bulk, perform credential-stuffing attacks against user accounts, or scrape sensitive data. This leads to resource exhaustion, reputation damage, inflated metrics, and compromised user trust. In high-value targets (email providers, payment systems, social networks), the cost of abuse can be substantial.
import random
def generate_captcha():
# Simple, predictable math problem
num1 = random.randint(1, 10)
num2 = random.randint(1, 10)
answer = num1 + num2
challenge = f"{num1} + {num2} = ?"
# Answer stored in session without additional validation
session['captcha_answer'] = answer
return challenge
def verify_captcha(user_input):
# No rate limiting, no token validation
if int(user_input) == session.get('captcha_answer'):
return True
return FalseWhy it's vulnerable:
The math problem is trivial to solve algorithmically, the answer is stored in plaintext in the session, and there is no rate limiting or token binding to prevent reuse or brute force.
import secrets
import hashlib
from datetime import datetime, timedelta
def generate_captcha():
# Use a third-party CAPTCHA service (e.g., reCAPTCHA, hCaptcha)
# or implement a robust challenge with high entropy
token = secrets.token_urlsafe(32)
challenge_id = secrets.token_hex(16)
# Store hashed token server-side with expiration
captcha_store[challenge_id] = {
'token_hash': hashlib.sha256(token.encode()).hexdigest(),
'expires': datetime.utcnow() + timedelta(minutes=5),
'attempts': 0
}
return challenge_id, token
def verify_captcha(challenge_id, user_token):
# Validate token, check expiration, enforce rate limits
if challenge_id not in captcha_store:
return False
record = captcha_store[challenge_id]
if datetime.utcnow() > record['expires'] or record['attempts'] > 5:
return False
record['attempts'] += 1
token_hash = hashlib.sha256(user_token.encode()).hexdigest()
return token_hash == record['token_hash']<?php
// Simple, reusable CAPTCHA
function generate_captcha() {
$num1 = rand(1, 10);
$num2 = rand(1, 10);
$answer = $num1 + $num2;
$_SESSION['captcha'] = $answer;
return "$num1 + $num2 = ?";
}
function verify_captcha($input) {
// No token, no expiration, no rate limiting
if ((int)$input === $_SESSION['captcha']) {
return true;
}
return false;
}
?>Why it's vulnerable:
The challenge is trivial, the answer is stored in plaintext in the session, and there is no mechanism to prevent reuse, brute force, or token binding.
<?php
// Use a third-party CAPTCHA service or implement robust server-side validation
function generate_captcha() {
$challenge_id = bin2hex(random_bytes(16));
$token = bin2hex(random_bytes(32));
// Store hashed token with expiration and rate limit
$_SESSION['captcha_' . $challenge_id] = [
'token_hash' => hash('sha256', $token),
'expires' => time() + 300, // 5 minutes
'attempts' => 0
];
return ['challenge_id' => $challenge_id, 'token' => $token];
}
function verify_captcha($challenge_id, $user_token) {
$key = 'captcha_' . $challenge_id;
if (!isset($_SESSION[$key])) {
return false;
}
$record = $_SESSION[$key];
if (time() > $record['expires'] || $record['attempts'] > 5) {
unset($_SESSION[$key]);
return false;
}
$record['attempts']++;
$token_hash = hash('sha256', $user_token);
return hash_equals($token_hash, $record['token_hash']);
}
?>- Sudden spike in account creation, form submissions, or login attempts from different IPs in a short time window. - Logs showing repeated CAPTCHA verification attempts from the same IP address or user agent. - Presence of many inactive or spam-like accounts created in bulk, or spam content posted in high volume.
