This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Testing for Captcha (OWASP-AT-008)"
| Line 7: | Line 7: | ||
== Description of the Issue == | == Description of the Issue == | ||
| − | + | ||
| + | Although CAPTCHA is not an authentication control, its implementation can be very efficient against: | ||
* any [https://www.owasp.org/index.php/Testing_for_user_enumeration enumeration attacks] (login, registration or password reset forms are often vulnerable to this kind of attacks - without CAPTCHA the attacker can gain a lot of valid usernames, phone number or any other sensitive information in a short time) | * any [https://www.owasp.org/index.php/Testing_for_user_enumeration enumeration attacks] (login, registration or password reset forms are often vulnerable to this kind of attacks - without CAPTCHA the attacker can gain a lot of valid usernames, phone number or any other sensitive information in a short time) | ||
* automated sending of many GET/POST requests in a short time where it is undesirable (e.g. SMS/MMS/email flooding), CAPTCHA provides a rate limiting function | * automated sending of many GET/POST requests in a short time where it is undesirable (e.g. SMS/MMS/email flooding), CAPTCHA provides a rate limiting function | ||
* automated creation/using of the account that should be used only by humans (e.g. creating webmail accounts, stop spamming) | * automated creation/using of the account that should be used only by humans (e.g. creating webmail accounts, stop spamming) | ||
| − | * automated posting to blogs, forums and wikis | + | * automated posting to blogs, forums and wikis, whether as a result of commercial promotion, or harassment and vandalism |
* any automated attacks than can gain/misuse sensitive information from the application | * any automated attacks than can gain/misuse sensitive information from the application | ||
| Line 21: | Line 22: | ||
* generated CAPTCHA images are weak, this can be identified (without any complex computer recognition systems) only by simple comparison with already broken captchas | * generated CAPTCHA images are weak, this can be identified (without any complex computer recognition systems) only by simple comparison with already broken captchas | ||
| − | |||
* the value of decoded CAPTCHA is sent by client (as a GET parameter or as a hidden field of POST form). This value is often: | * the value of decoded CAPTCHA is sent by client (as a GET parameter or as a hidden field of POST form). This value is often: | ||
| Line 39: | Line 39: | ||
== Gray Box testing and example == | == Gray Box testing and example == | ||
| + | |||
| Line 44: | Line 45: | ||
'''Captcha Decoders'''<br> | '''Captcha Decoders'''<br> | ||
| − | [http://libcaca.zoy.org/wiki/PWNtcha (Opensource) PWNtcha captcha decoder] | + | * [http://libcaca.zoy.org/wiki/PWNtcha (Opensource) PWNtcha captcha decoder] |
| − | [http://churchturing.org/captcha-dist/ (Opensource) The Captcha Breaker] | + | * [http://churchturing.org/captcha-dist/ (Opensource) The Captcha Breaker] |
| − | [http://www.lafdc.com/captcha/ (Commercial) Captcha decoder] | + | * [http://www.lafdc.com/captcha/ (Commercial) Captcha decoder] |
'''Articles'''<br> | '''Articles'''<br> | ||
| − | [http://www.cs.sfu.ca/~mori/research/gimpy/ Breaking a Visual CAPTCHA] | + | * [http://www.cs.sfu.ca/~mori/research/gimpy/ Breaking a Visual CAPTCHA] |
| − | [http://www.puremango.co.uk/cm_breaking_captcha_115.php Breaking CAPTCHAs Without Using OCR] | + | * [http://www.puremango.co.uk/cm_breaking_captcha_115.php Breaking CAPTCHAs Without Using OCR] |
| − | [http://securesoftware.blogspot.com/2007/11/captcha-placebo-security-control-for.html Why CAPTCHA is not a security control for user authentication] | + | * [http://securesoftware.blogspot.com/2007/11/captcha-placebo-security-control-for.html Why CAPTCHA is not a security control for user authentication] |
Revision as of 21:10, 28 July 2008
OWASP Testing Guide v3 Table of Contents
This article is part of the OWASP Testing Guide v3. The entire OWASP Testing Guide v3 can be downloaded here.
OWASP at the moment is working at the OWASP Testing Guide v4: you can browse the Guide here
Brief Summary
CAPTCHA ("Completely Automated Public Turing test to tell Computers and Humans Apart") is a type of challenge-response test used by many web applications to ensure that the response is not generated by a computer. CAPTCHA implementations are often vulnerable to various kinds of attacks even if the generated CAPTCHA is unbreakable. This section will help you to identify these kinds of attacks and propose possible solutions.
Description of the Issue
Although CAPTCHA is not an authentication control, its implementation can be very efficient against:
- any enumeration attacks (login, registration or password reset forms are often vulnerable to this kind of attacks - without CAPTCHA the attacker can gain a lot of valid usernames, phone number or any other sensitive information in a short time)
- automated sending of many GET/POST requests in a short time where it is undesirable (e.g. SMS/MMS/email flooding), CAPTCHA provides a rate limiting function
- automated creation/using of the account that should be used only by humans (e.g. creating webmail accounts, stop spamming)
- automated posting to blogs, forums and wikis, whether as a result of commercial promotion, or harassment and vandalism
- any automated attacks than can gain/misuse sensitive information from the application
Using CAPTCHAs as a CSRF protection is not recommended (because there are stronger CSRF protections).
CAPTCHA implementations are often vulnerable to these common attacks:
- generated CAPTCHA images are weak, this can be identified (without any complex computer recognition systems) only by simple comparison with already broken captchas
- the value of decoded CAPTCHA is sent by client (as a GET parameter or as a hidden field of POST form). This value is often:
1) encrypted by simple algorithm and can be easily decrypted by observing of multiple "decoded CAPTCHA" values 2) hashed by weak hash function (e.g. MD5) and can be broken using a rainbow table
- many CAPTCHA implementations are vulnerable to replay attacks (they do not keep track what ID of CAPTCHA image is sent to the user. Therefore the attacker can simple retrieve
the appropriate CAPTCHA image and it's ID, solve it and send old values of ID and decoded CAPTCHA) put the answer along with the corresponding CAPTCHA ID)
- many CAPTCHA implementations do not destroy the session when the correct phrase is entered - by reusing the session ID of a known CAPTCHA it is possible to bypass CAPTCHA protected page
Black Box testing and example
Gray Box testing and example
References
Captcha Decoders
Articles
