View source for Testing for Captcha (OWASP-AT-012)

{{Template:OWASP Testing Guide v4}}


=== WARNING: Captcha protection is considered to be an ineffective security mechanism! ===

Most current used Captcha images can be easily cracked in a fully automated way using many commercial or opensource services. Commercial services are usually very cheap and provide a simple API for most programming languages.
<br>
'''It is not recommended to use Captcha protection for security-critical applications''', in this case it is more suitable to use SMS text messages or OTP tokens instead.
[[File:https://www.owasp.org/images/1/11/Image2.jpeg]]

== Brief Summary ==
<br>
CAPTCHA ("Completely Automated Public Turing test to tell Computers and Humans Apart") is a type of challenge-response test used by many web applications to ensure that the response is not generated by a computer. 
<br>

== Description of the Issue == 
<br>
...here: Short Description of the Issue: Topic and Explanation
<br>
== Black Box testing and example ==
'''Testing for Topic X vulnerabilities:''' <br>
...<br>
'''Result Expected:'''<br>
...<br><br>
== References ==
'''Whitepapers'''<br>
...<br>
'''Tools'''<br>
...<br>