CAPTCHA-Aware Authentication Testing Script

Overview

This project demonstrates how automated clients interact with web-based authentication systems that use session management and simple arithmetic CAPTCHA challenges.

The script:

1. Creates and maintains an HTTP session.
2. Extracts and solves arithmetic CAPTCHA challenges from HTML responses.
3. Demonstrates how differing server responses can reveal account enumeration weaknesses.
4. Automates login workflow testing using username and password wordlists.
5. Handles session cookies and CAPTCHA regeneration between requests.

Educational Purpose Only

This project is intended for learning about web authentication mechanisms, CAPTCHA handling, session management, and common security misconfigurations. It should only be used against systems you own or are explicitly authorized to test.

---

Features

Session Management

The script uses Python's requests.Session() object to maintain a persistent HTTP session.

Benefits include:

• Automatic cookie handling
• Persistent session state
• Reduced connection overhead
• More realistic browser-like behavior

---

CAPTCHA Detection and Solving

Many web applications use simple arithmetic CAPTCHAs such as:

5 + 3 = ?
12 - 4 = ?
8 * 7 = ?

The script automatically:

1. Extracts the expression using a regular expression.
2. Evaluates the expression.
3. Submits the result with subsequent requests.

Example:

7 + 8 = ?

Extracted expression:

7 + 8

Solved value:

15

---

Response Analysis

The script demonstrates how applications sometimes return different messages for different authentication failures.

Example:

Scenario	Server Response
Unknown username	"User does not exist"
Existing username + wrong password	"Invalid password"

Such differences can unintentionally reveal information about valid accounts.

---

Wordlist Support

The script loads candidate usernames and passwords from text files:

usernames.txt
passwords.txt

Each line represents a single entry.

Example:

admin
john
alice
guest

---

CAPTCHA Refresh Handling

Some applications generate a new CAPTCHA after every authentication attempt.

The script automatically:

1. Parses the updated response.
2. Extracts the next CAPTCHA.
3. Solves it before the next request.

---

How It Works

Step 1: Initialize Session

The script:

• Creates an HTTP session.
• Requests the login page.
• Attempts to locate a CAPTCHA challenge.

session = requests.Session()
response = session.get(url)

---

Step 2: Solve CAPTCHA

The login page is scanned using a regular expression.

regex = re.compile(r"(\\d+\\s[+*/-]\\s\\d+)\\s\\=\\s\\?")

The extracted arithmetic expression is evaluated and returned.

---

Step 3: Authentication Workflow Testing

For each username:

1. A login request is sent.
2. The CAPTCHA solution is included.
3. The server response is analyzed.
4. The CAPTCHA is refreshed if necessary.

The process continues until a response differs from the expected failure condition.

---

Step 4: Password Testing

Once a valid account is identified during testing, the script iterates through the supplied password list.

Each request:

• Uses the active session
• Includes the current CAPTCHA solution
• Analyzes the returned response

The process continues until a successful authentication response is observed.

---

Project Structure

project/
│
├── script.py
├── usernames.txt
├── passwords.txt
└── README.md

---

Requirements

Python 3.x

Install dependencies:

pip install requests

---

Concepts Demonstrated

This project provides practical examples of:

• HTTP requests
• Session handling
• Cookie management
• CAPTCHA extraction
• Regular expressions
• Response parsing
• Authentication workflows
• Error handling
• Rate limiting considerations
• Security testing methodology

---

Security Lessons

This project highlights several common authentication design issues:

Username Enumeration

Applications should avoid revealing whether an account exists.

Instead of:

User does not exist

and

Invalid password

applications should return a generic message such as:

Invalid username or password

---

Weak CAPTCHA Design

Simple arithmetic CAPTCHAs can be automated easily.

Modern implementations should use stronger anti-automation controls.

---

Rate Limiting

Authentication endpoints should enforce:

• Request throttling
• Temporary lockouts
• Progressive delays

to reduce automated login attempts.

---

Account Lockout Policies

Repeated failed authentication attempts should trigger defensive controls to protect user accounts.

---

Disclaimer

This repository is intended solely for educational purposes, security research, and authorized testing environments.

Do not use this code against systems, applications, or networks without explicit permission from the owner. The author assumes no responsibility for misuse of this software.