Collected research

Bypassing CAPTCHAs by Impersonating CAPTCHA Providers

Gursev Singh Kalra · gursevkalra.blogspot.com

CAPTCHA verification APIs, reCAPTCHA included, validated over plain HTTP, so a man in the middle can sniff the private key and impersonate the provider. Because validation answers are a tiny predictable set, the attacker can clip the request and return success himself; the clipcaptcha tool automates this with provider signatures and five operating modes.

Record

Researcher

Gursev Singh Kalra

Published by

gursevkalra.blogspot.com

Topic

Other

In the archive

• Collected in the 2012 research round

Related sources

• Bypassing CAPTCHAs by Impersonating CAPTCHA Providers Whitepaper
• OpenSecurityResearch/clipcaptcha
• clipcaptcha
• Outerz0ne 9 - 02 Gursev Kalra - Impersonating CAPTCHA Providers

Tags

• https
• auth-bypass
• tooling
• info-leak
• owasp-a01-2021
• owasp-a02-2021

This page is the archive's own catalogue record. The research is the work of Gursev Singh Kalra, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.