Collaborate Disseminate
I have an web application which uses login user password and captcha for login. Is there a way to perform vulnerability assessment using AppScan or Burpsuite tools to capture the CAPTCHA automatically and crawl and audit the application
i have found a simple script php with untrusted user input to make a captcha
I would like to know if this practice can lead to a code exuction or os command injection ?
The user input looks like this :
https://x.com/x.php?captcha=YToyOnt… Continue reading Insecure captcha to RCE? [closed]
We are a small nonprofit that accepts donations online. Our site is being hammered by hundreds of fraudulent credit card submissions per day, coming from multiple IP’s all over the world (a distributed attack). 99% of these are declined, h… Continue reading How can I stop fraudulent credit card submissions on a donation site?
Can I pass through this captcha using pytesseract?
Continue reading Is it possible to break this captcha using pytesseract? [closed]
How does Cloudflare web firewall work? When someone tries to enter a website, they first go through the Cloudflare server and then, if a captcha is solved, they can see the content of the website.
So from what I understand it goes like thi… Continue reading How does Cloudflare firewall work?
Cloudflare’s CEO said it is replacing Google’s reCAPTCHA tool with hCaptcha due to pricing, privacy and availability concerns. Continue reading Cloudflare Axes Google reCAPTCHA Due to Privacy, Price
My idea is to use a sort of layered CAPTCHA model (4 layers – from which layer 0 is no captcha) with difficulty as primary focus.
My first focus beside stopping bots is to make the visitor more and more aware of what he’s doing.
Is it possible to bruteforce a 6 characters az-09 captcha in an offline attack?
There is a public query form in my web app, and architecture team asking to authenticate the web app with OAuth2 like this, but I don’t believe it will be of any help.
I believe best way to protect is by reCAPTCHA.
Can we prevent DDoS or… Continue reading Can we prevent DDoS or spam form submission with client authentication?
How secure is a 4 digit numbers only captcha?
How many tries will take to be able to bruteforce that captcha?
Continue reading How secure is a 4 digit numbers only captcha? [on hold]