The ID is used in step 5 for an API GET request to 2Captcha to retrieve the solved CAPTCHA.

Attacker sends the CAPTCHA to the 2Captcha service using HTTP POST and receives a Captcha ID, which is a numerical ID attributed with the CAPTCHA image that was submitted to 2Captcha.Attacker requests API token from 2Captcha website.Attacker requests the CAPTCHA iframe source and URL used to embed the CAPTCHA image from the target site and saves it locally.Upon accessing the site, the viewer is greeted with the image below, asking whether the visitor wants to 1) work for 2Captcha or 2) purchase 2Captcha as a service. This article will use 2Captcha to demonstrate how attackers integrate the solution to orchestrate credential stuffing attacks. These shady enterprises are so ubiquitous that many can be found with a quick Google search, including: Cybercriminals subscribe to a service for CAPTCHA solutions, which streamline into their automation tools via APIs, populating the answers on the target website. A common method is to use a CAPTCHA solving service, which utilizes low-cost human labor in developing countries to solve CAPTCHA images. There are multiple ways CAPTCHA can be defeated. The good guys responded with “hardened” CAPTCHAs but the result remains the same: the test that attempts to stop automation is circumvented with automation. These days, organizations use CAPTCHA in an attempt to prevent more sinister automated attacks like credential stuffing.Īlmost as soon as CAPTCHA was introduced, however, cybercriminals developed effective methods to bypass it. In the 90s, this meant preventing spam bots. The CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart), was originally designed to prevent bots, malware, and artificial intelligence (AI) from interacting with a web page.

Recaptcha bypass requests