PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Cracking reCAPTCHA, Turbo Intruder style

portswigger.net | research | #bug-bounty | #web-security | #portswigger | #turbo-intruder | #race-condition | #bypass | #recaptcha
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

James Kettle uses Turbo Intruder's last-byte synchronization to trigger a race condition that partially bypasses Google reCAPTCHA, demonstrated against Reddit after Google declined to fix it.
Published
Collected

Related coverage

research · portswigger.net
Turbo Intruder: Embracing the billion-request attack
James Kettle introduces Turbo Intruder, a research-grade Burp Suite extension built for speed, enabling billion-request attacks, multi-day brute-force and race-condition exploitation.
research · portswigger.net
Abusing JavaScript frameworks to bypass XSS mitigations
Gareth Heyes abuses the Mavo JavaScript framework's $url object to build DOM-based XSS that bypasses NoScript's XSS filter, and shows risks from attacker-controlled data sources.
blog · yeswehack.com
Concurrency exploits: The ultimate Bug Bounty guide to exploiting race condition vulnerabilities in web applications
A 'Vulnerability Vectors' deep dive into race conditions: last-byte synchronisation and HTTP/2 single-packet attacks, exploiting with Burp Suite Turbo Intruder, plus CVEs and mitigations.
vulnerability · vercel.com
The Vercel Bug Bounty Program is now publicly available
Vercel's Bug Bounty Program is now public on HackerOne, covering all Vercel products and open-source projects. Learn how to participate and report findings.
vulnerability · vercel.com
The Vercel OSS Bug Bounty program is now available
Vercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
Back