This post has been sitting in draft state for almost two years now so I figured I'd publish it. The captcha reload attack in particular attack targets captchas that support some form of user supplied input and change the captcha value in session upon image creation. In it's simplest form the attack works like this;
User suppplied text in captcha url (http://domain.com/captcha/image.php?w=aZcG5x)
Captcha value = query string. I'm not going to dicuss this one.
User suppplied seed in captcha url (http://domain.com/captcha/image.php?r=13323)
A known seed is as good as providing the captcha string in url. Once a human decodes the captcha message it will never change.
User suppplied text in domain state in captcha url (http://domain.com/captcha/image.php?t=HFG_UJHNB_jBHHJGSDJSMSAKDJGSJetcetc)
As above if the session is updated. In the penetration test where I found this the session was not updated, however the text can be used to identify known captcha text if a human decodes a few hundred captchas (they were only using 4 letters). In this case the attacker would reload the step1 url until a known domainstate string appears and submit the form with certainty of the captcha value.
User suppplied complexity in captcha url (http://domain.com/captcha/image.php?characters=3)
This one comes from an old copy of this script: http://www.white-hat-web-design.co.uk/blog/php-captcha-security-images/. By reloading the captcha the captcha complexity would be reduced to 3 characthers This script also allowed you to increase the image size which caused the letters to appear with far less obfuscation. Older versions of the script allowed you to lowver the character count to 1 and allowed image sizes so large that you could remove the text obfuscation completely or cause a denial of service attack by generating very large images.
Since the white hat web guys are kind enough to host a demo I decided to make a video showing how the attack works:
- Attacker visits page with captcha (session has captcha value y)
- Attacker loads a targeted captcha url which changes the value of the session (session has captcha value z)
- Attacker submits form from step1 with a certainty or increased likelyhood of having the correct captcha due to step2.
User suppplied text in captcha url (http://domain.com/captcha/image.php?w=aZcG5x)
Captcha value = query string. I'm not going to dicuss this one.
User suppplied seed in captcha url (http://domain.com/captcha/image.php?r=13323)
A known seed is as good as providing the captcha string in url. Once a human decodes the captcha message it will never change.
User suppplied text in domain state in captcha url (http://domain.com/captcha/image.php?t=HFG_UJHNB_jBHHJGSDJSMSAKDJGSJetcetc)
As above if the session is updated. In the penetration test where I found this the session was not updated, however the text can be used to identify known captcha text if a human decodes a few hundred captchas (they were only using 4 letters). In this case the attacker would reload the step1 url until a known domainstate string appears and submit the form with certainty of the captcha value.
User suppplied complexity in captcha url (http://domain.com/captcha/image.php?characters=3)
This one comes from an old copy of this script: http://www.white-hat-web-design.co.uk/blog/php-captcha-security-images/. By reloading the captcha the captcha complexity would be reduced to 3 characthers This script also allowed you to increase the image size which caused the letters to appear with far less obfuscation. Older versions of the script allowed you to lowver the character count to 1 and allowed image sizes so large that you could remove the text obfuscation completely or cause a denial of service attack by generating very large images.
Since the white hat web guys are kind enough to host a demo I decided to make a video showing how the attack works:
