hunt-captcha-bypass

1## Autonomous Testing Priority
2 
3**The fastest test: just omit the CAPTCHA field entirely. Most CAPTCHA bypass bugs are client-side-only validation.**
4 
5**Pattern 1 — Omit the CAPTCHA field (most common, most automatable):**
61. GET the form/endpoint that shows a CAPTCHA to understand its field name (usually `g-recaptcha-response`, `captcha`, `captcha_token`, `captcha_answer`, `h-captcha-response`)
72. POST the form with ALL fields EXCEPT the CAPTCHA field
83. If the action succeeds (200, redirect, or "success" message) → no server-side CAPTCHA validation
94. Proof: the state-changing action completes without a valid CAPTCHA field (compare against a baseline request that includes it)
10 
11**Pattern 2 — Empty or null CAPTCHA value:**
12Instead of omitting the field entirely, include it with an empty string, `null`, `0`, or `undefined`:
13```
14captcha=&email=test@example.com&password=test123
15```
16Some apps validate field presence but not content.
17 
18**Pattern 3 — Replay a previously solved CAPTCHA token:**
191. Complete one legitimate CAPTCHA challenge and capture the `g-recaptcha-response` token
202. Submit a second request immediately with the SAME token value
213. If the second submission also succeeds → token is not single-use (replay attack)
224. A replayed token can be shared across automated requests
23 
24**Pattern 4 — Test without CAPTCHA on similar endpoints:**
25…