Testing for Captcha (OWASP-AT-008)

Brief Summary
CAPTCHA ("Completely Automated Public Turing test to tell Computers and Humans Apart") is a type of challenge-response test used by many web applications to ensure that the response is not generated by a computer. CAPTCHA implementations are often vulnerable to various kinds of attacks even if the generated CAPTCHA is unbreakable. This section will help you to identify these kinds of attacks.

Description of the Issue
Although CAPTCHA is not an authentication control, its use can be very efficient against:


 * enumeration attacks (login, registration or password reset forms are often vulnerable to enumeration attacks - without CAPTCHA the attacker can gain a lot of valid usernames, phone number or any other sensitive information in a short time)
 * automated sending of many GET/POST requests in a short time where it is undesirable (e.g. SMS/MMS/email flooding), CAPTCHA provides a rate limiting function
 * automated creation/using of the account that should be used only by humans (e.g. creating webmail accounts, stop spamming)
 * automated posting to blogs, forums and wikis, whether as a result of commercial promotion, or harassment and vandalism
 * automated attacks than can gain/misuse sensitive information from the application

Using CAPTCHAs as a CSRF protection is not recommended (because there are stronger CSRF protections).

CAPTCHA implementations are often vulnerable to these common threats:
 * generated CAPTCHA images are weak, this can be identified (without any complex computer recognition systems) only by simple comparison with already broken captchas

1) encrypted by simple algorithm and can be easily decrypted by observing of multiple "decoded CAPTCHA" values 2) hashed by weak hash function (e.g. MD5) and can be broken using a rainbow table the appropriate CAPTCHA image and it's ID, solve it and send old values of ID and decoded CAPTCHA) put the answer along with the corresponding CAPTCHA ID)
 * the value of decoded CAPTCHA is sent by client (as a GET parameter or as a hidden field of POST form). This value is often:
 * many CAPTCHA implementations are vulnerable to replay attacks (they do not keep track what ID of CAPTCHA image is sent to the user. Therefore the attacker can simple retrieve
 * many CAPTCHA implementations do not destroy the session when the correct phrase is entered - by reusing the session ID of a known CAPTCHA it is possible to bypass CAPTCHA protected page

Black Box testing and example
Use intercepting fault injection proxy (e.g. WebScarab to:

Find out if the similar CAPTCHAs are already broken, broken CAPTCHA images can be found on gimpy, PWNtcha, lafdc.
 * identify all parameters that are sent in addition to the decoded CAPTCHA value from the client to the server (these parameters can contain encrypted or hashed values of decoded CAPTCHA and CAPTCHA ID number)
 * try to send old decoded CAPTCHA value with old CAPTCHA ID (if the application accepts it, it is vulnerable to replay attacks)
 * try to send old decoded CAPTCHA value with old session ID (if the application accepts it, it is vulnerable to replay attacks)

Gray Box testing and example
Audit the application source code in order to reveal:


 * used CAPTCHA implementation and version - there are many known vulnerabilities in widely used CAPTCHA implementations, see http://osvdb.org/search?request=captcha
 * if the application sends encrypted or hashed value from the client (which is a very bad security practice) verify if used encryption or hash algorithm is sufficiently strong