vendor:
Invisible RECAPTCHA
by:
Matamorphosis
N/A
CVSS
N/A
Spoof Bypass
CWE
Product Name: Invisible RECAPTCHA
Affected Version From:
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested: Windows and Ubuntu 19.10
2020
Google Invisible RECAPTCHA 3 – Spoof Bypass
This tool allows a user to bypass Version 3 of Google's Invisible RECAPTCHA by creating a spoofed web app that leverages the same RECAPTCHA, by providing the victims site key. What makes a site vulnerable? 1. They are using Version 3 of Google's Invisible RECAPTCHA 2. They allow the site key to be used on 'localhost'. However, while currently untested you could try adding the DNS name of the target you are attacking and try resolving it to 127.0.0.1 in your hosts file. NOTE: Exploit users need to have a functional understanding of both Python and JavaScript to make the necessary changes to run this exploit.