the-web-application-hackers-handbook

Chapter 14 n Automating Customized Attacks 611
TRY IT!
http://mdsec.net/feedback/12/
http://mdsec.net/feedback/24/
http://mdsec.net/feedback/31/
A further common bug in CAPTCHA implementations is that a puzzle can be
solved manually on a single occasion, and the solution can be replayed in multiple
requests. Normally, each puzzle should be valid for only a single attempt, and
the application should discard it when an attempted solution is received. If this
is not done, it is straightforward to solve a puzzle once in the normal way and
then use the solution to perform an unlimited number of automated requests.
TRY IT!
http://mdsec.net/feedback/39/
NOTE Some applications have a deliberate code path that circumvents the
CAPTCHA to permit use by certain authorized automated processes. In these
instances, it is often possible to bypass the CAPTCHA simply by not supplying
the relevant parameter name.
Automatically Solving CAPTCHA Puzzles
In principle, most types of CAPTCHA puzzles can be solved by a computer, and
in practice, many high-profile puzzle algorithms have been defeated in this way.
For standard puzzles involving a distorted word, solving the puzzle involves
the following steps:
1. Removal of noise from the image
2. Segmentation of the image into individual letters
3. Recognition of the letter in each segment
With today’s technology, computers are quite effective at removing noise and
recognizing letters that have been correctly segmented. The most significant
challenges arise with segmenting the image into letters, particularly where
letters overlap and are heavily distorted.
For simple puzzles in which segmentation into letters is trivial, it is likely
that some homegrown code can be used to remove image noise and pass the
text into an existing OCR (optical character recognition) library to recognize the
letters. For more complex puzzles in which segmentation is a serious challenge,