Testing for Captcha (OWASP-AT-012) - Revision history

Wilder: /* WARNING: CAPTCHA protection is an ineffective security mechanism and should be perceived as a "rate limiting" protection only! */

2013-11-21T02:41:46Z

‎WARNING: CAPTCHA protection is an ineffective security mechanism and should be perceived as a "rate limiting" protection only!

Wilder: /* Description of the Issue */

2013-11-21T02:40:40Z

‎Description of the Issue

Wilder: /* References */

2013-11-18T16:45:45Z

‎References

Wilder: /* Gray Box testing and example */

2013-11-18T04:21:03Z

‎Gray Box testing and example

Wilder: /* Common CAPTCHA vulnerabilities and attacks */

2013-11-18T04:20:13Z

‎Common CAPTCHA vulnerabilities and attacks

Wilder: /* Black Box testing and example */

2013-11-18T04:19:14Z

‎Black Box testing and example

Wilder: /* Solution */

2013-11-18T04:18:49Z

‎Solution

Wilder: /* Common CAPTCHA vulnerabilities and attacks */

2013-11-18T04:17:02Z

‎Common CAPTCHA vulnerabilities and attacks

Wilder: /* Description of the Issue */

2013-11-18T04:16:13Z

‎Description of the Issue

Wilder: /* Description of the Issue */

2013-11-18T04:15:47Z

‎Description of the Issue

@@ Line 6: / Line 6: @@
 Most current used CAPTCHA images can be easily cracked in a fully automated way using online cracking services. Commercial services are usually very cheap and provide a simple API for most programming languages.
 <br/>
-'''It is not recommended to use CAPTCHA protection for security-critical applications''' (in this case SMS authentication or OTP tokens is more suitable solution).
+'''In security critical applications''' it is more suitable to use '''alternative verification channels''' (SMS authentication, OTP tokens etc).
 <br/><br/>
 Example of Google reCAPTCHA cracked in 7 seconds by commercial automated cracking service:<br/>

@@ Line 31: / Line 31: @@
 * <strike>Any automated attacks that massively gain or misuse sensitive information from the application</strike>
 * '''Simple''' enumeration attacks, '''simple''' spambots/adbots, '''simple''' DOS attacks and '''less sophisticated''' attackers
 <br/>

@@ Line 110: / Line 110: @@
 * [http://www.mcafee.com/au/resources/white-papers/foundstone/wp-attacking-captchas-for-fun-profit.pdf Attacking CAPTCHAs for Fun and Profit]
 * [http://www.mcafee.com/au/resources/white-papers/foundstone/wp-bypassing-captchas.pdf Bypassing CAPTCHAs by Impersonating CAPTCHA Providers]
 * [http://www.slideshare.net/DefCamp/attacks-against-captchasystems Attacks Against Captcha Systems]
 * [http://homepages.cs.ncl.ac.uk/jeff.yan/google.pdf The Robustness of Google CAPTCHAs]

@@ Line 91: / Line 91: @@
 == Gray Box testing and example ==
 Audit the application source code in order to reveal:
-* used CAPTCHA implementation and version - there are many known vulnerabilities in widely used CAPTCHA implementations, see [http://osvdb.org/search?request=captcha http://osvdb.org/search?request=captcha]
+* Used CAPTCHA implementation and version - there are many known vulnerabilities in widely used CAPTCHA implementations, see [http://osvdb.org/search?request=captcha http://osvdb.org/search?request=captcha]
-* if the application sends encrypted or hashed value from the client, verify if used encryption or hash algorithm is sufficiently strong
+* If the application sends encrypted or hashed value from the client, verify if used encryption or hash algorithm is sufficiently strong
 == References ==

@@ Line 40: / Line 40: @@
 * '''Generated CAPTCHA is weak'''
-** Be aware that most current CAPTCHAs can be considered to be weak and easily crackable using existing CAPTCHA cracking services (see below)
+** Be aware that most current CAPTCHAs can be considered to be weak, and easily crackable using existing CAPTCHA cracking services (see below)
 * '''Client-side storage and hidden fields'''

@@ Line 82: / Line 82: @@
 * Use an intercepting fault injection proxy (e.g., [https://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] or BurpSuite) to:
-** identify all parameters which are sent (in addition to the decoded CAPTCHA value) from the client to the server in order to check if these parameters contain encrypted or hashed values of decoded CAPTCHA and CAPTCHA ID number
+** Identify all parameters which are sent (in addition to the decoded CAPTCHA value) from the client to the server in order to check if these parameters contain encrypted or hashed values of decoded CAPTCHA and CAPTCHA ID number
-** try to send an old decoded CAPTCHA value with an old CAPTCHA ID (if the application accepts them, it is vulnerable to replay attacks)
+** Try to send an old decoded CAPTCHA value with an old CAPTCHA ID (if the application accepts them, it is vulnerable to replay attacks)
-** try to send an old decoded CAPTCHA value with an old session ID (if the application accepts them, it is vulnerable to replay attacks)
+** Try to send an old decoded CAPTCHA value with an old session ID (if the application accepts them, it is vulnerable to replay attacks)
 * Find out if similar CAPTCHAs have already been broken.

@@ Line 74: / Line 74: @@
 If it is implemented, the following considerations should be taken into account:
-* no CAPTCHA information (except the image itself) should be stored on the client side
+* No CAPTCHA information (except the image itself) should be stored on the client side
-* the client should have no "control" over the CAPTCHA content
+* The client should have no "control" over the CAPTCHA content
 * CAPTCHA images should be always randomly generated without possibility to perform image preprocessing, segmentation and classification
 * CAPTCHA images should not be reused.

@@ Line 40: / Line 40: @@
 * '''Generated CAPTCHA is weak'''
-** be aware that most current CAPTCHAs can be considered to be weak and easily crackable using existing CAPTCHA cracking services (see below)
+** Be aware that most current CAPTCHAs can be considered to be weak and easily crackable using existing CAPTCHA cracking services (see below)
 * '''Client-side storage and hidden fields'''
-** the value of decoded CAPTCHA is sent by the client (as a GET parameter or as a hidden field of POST form). This value is often:
+** The value of decoded CAPTCHA is sent by the client (as a GET parameter or as a hidden field of POST form). This value is often:
-*** encrypted by a simple algorithm and can be easily decrypted by observing of multiple decoded CAPTCHA values
+*** Encrypted by a simple algorithm and can be easily decrypted by observing of multiple decoded CAPTCHA values
-*** hashed by a weak hash function (e.g., MD5) that can be easily broken
+*** Hashed by a weak hash function (e.g., MD5) that can be easily broken
 * '''The Chosen CAPTCHA text attack'''
-** rarely CAPTCHA is verified on the client side or verified on the server side but generated on the client side (in javascript)
+** Rarely CAPTCHA is verified on the client side or verified on the server side but generated on the client side (in javascript)
 * '''Arithmetic CAPTCHAs'''
-** if arithmetic questions are displayed in cleartext, it is trivial to bypass this CAPTCHA, just parse the HTML content, extract the arithmetic question and solve it
+** If arithmetic questions are displayed in cleartext, it is trivial to bypass this CAPTCHA, just parse the HTML content, extract the arithmetic question and solve it
 * '''Limited set CAPTCHAs'''
-** if generated CAPTCHA questions have a very limited set of possible answers, it is trivial to gain all of them, solve and use them subsequently (CAPTCHA Rainbow Tables can be built using CAPTCHA cryptographic hashes and the corresponding solutions)
+** If generated CAPTCHA questions have a very limited set of possible answers, it is trivial to gain all of them, solve and use them subsequently (CAPTCHA Rainbow Tables can be built using CAPTCHA cryptographic hashes and the corresponding solutions)
 * '''The Chosen CAPTCHA identifier attack'''
-** sometimes the application returns CAPTCHA to the user but does not store its ID or solution in the HTTP session (does not keep track of what ID of which CAPTCHA image is sent to the user). This ID is subsequently extracted by the application from the received HTTP request and then used to perform CAPTCHA solution lookup for verification. This behaviour can be exploited by solving a single CAPTCHA, recording its unique ID and then submitting this stored ID of the already decoded CAPTCHA over multiple requests (the ID of a CAPTCHA could be a hash of the decoded CAPTCHA or any unique identifier)
+** Sometimes the application returns CAPTCHA to the user but does not store its ID or solution in the HTTP session (does not keep track of what ID of which CAPTCHA image is sent to the user). This ID is subsequently extracted by the application from the received HTTP request and then used to perform CAPTCHA solution lookup for verification. This behaviour can be exploited by solving a single CAPTCHA, recording its unique ID and then submitting this stored ID of the already decoded CAPTCHA over multiple requests (the ID of a CAPTCHA could be a hash of the decoded CAPTCHA or any unique identifier)
 * '''CAPTCHA fixation'''
-** exploits a potential race condition in the CAPTCHA implementation relying on unique IDs for finite CAPTCHA set:
+** Exploits a potential race condition in the CAPTCHA implementation relying on unique IDs for finite CAPTCHA set:
 # Client requests a CAPTCHA from the server with a valid SESSIONID.
 # The server picks a random CAPTCHA identifier from the finite set of CAPTCHAs it has.
@@ Line 68: / Line 68: @@
 * '''In-session CAPTCHA brute-forcing'''
-** the application does not destroy the HTTP session when the given CAPTCHA is already solved - by re-using the session ID of a known CAPTCHA it is possible to bypass another CAPTCHA protected page
+** The application does not destroy the HTTP session when the given CAPTCHA is already solved - by re-using the session ID of a known CAPTCHA it is possible to bypass another CAPTCHA protected page
 == Solution ==

@@ Line 26: / Line 26: @@
 * Automated sending of many GET/POST requests in a short time where it is undesirable (e.g., SMS/MMS/email flooding), CAPTCHA provides a rate limiting function
-* <strike>[https://www.owasp.org/index.php/Testing_for_user_enumeration enumeration attacks] (login, registration or password reset forms are often vulnerable to enumeration attacks - without CAPTCHA the attacker can gain valid usernames, phone numbers or any other sensitive information in a short time)</strike>
+* <strike>[https://www.owasp.org/index.php/Testing_for_user_enumeration Enumeration attacks] (login, registration or password reset forms are often vulnerable to enumeration attacks - without CAPTCHA the attacker can gain valid usernames, phone numbers or any other sensitive information in a short time)</strike>
 * <strike>Automated creation/using of the account that should be used only by humans (e.g., creating webmail accounts, stop spamming)</strike>
 * <strike>Automated posting to blogs, forums and wikis, whether as a result of commercial promotion, or harassment and vandalism</strike>

@@ Line 25: / Line 25: @@
 Despite the above-described CAPTCHA weakness, it can be still used against:
-* automated sending of many GET/POST requests in a short time where it is undesirable (e.g., SMS/MMS/email flooding), CAPTCHA provides a rate limiting function
+* Automated sending of many GET/POST requests in a short time where it is undesirable (e.g., SMS/MMS/email flooding), CAPTCHA provides a rate limiting function
 * <strike>[https://www.owasp.org/index.php/Testing_for_user_enumeration enumeration attacks] (login, registration or password reset forms are often vulnerable to enumeration attacks - without CAPTCHA the attacker can gain valid usernames, phone numbers or any other sensitive information in a short time)</strike>
-* <strike>automated creation/using of the account that should be used only by humans (e.g., creating webmail accounts, stop spamming)</strike>
+* <strike>Automated creation/using of the account that should be used only by humans (e.g., creating webmail accounts, stop spamming)</strike>
-* <strike>automated posting to blogs, forums and wikis, whether as a result of commercial promotion, or harassment and vandalism</strike>
+* <strike>Automated posting to blogs, forums and wikis, whether as a result of commercial promotion, or harassment and vandalism</strike>
-* <strike>any automated attacks that massively gain or misuse sensitive information from the application</strike>
+* <strike>Any automated attacks that massively gain or misuse sensitive information from the application</strike>
-* '''simple''' enumeration attacks, '''simple''' spambots/adbots, '''simple''' DOS attacks and '''less sophisticated''' attackers
+* '''Simple''' enumeration attacks, '''simple''' spambots/adbots, '''simple''' DOS attacks and '''less sophisticated''' attackers
 In security critical applications, it is more suitable to use alternative verification channels (SMS authentication, OTP etc).