CAPTCHA stands for Completely Automated Public
Turing Test to Tell Computers and Humans Apart. So basically, it exists to
prevent responses & requests from bots.
The use of CAPTCHAs makes the word of a hacker much harder because the
process becomes much slower. For
example, having Captchas in a login page helps limit bruteforcing attacks. In
fact, having Captchas in any GET/POST requests "provides a rate limiting
function".
Captcha's can be
decoded and in some cases they are subjected to replay
attacks. This occurs when the
application does not keep track of "What ID of Captcha image is sent to
the user". So a hacker can just
decode it, and send the ID and decoded value to the application within a
bruteforcing program.
If one captcha
system has been broken, it means any captcha created by that system can be
decoded. WASPS lists the following places to find decoded Captchas.
No comments:
Post a Comment