Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →elementalsouls/hunt-captcha-bypass
Hunt CAPTCHA Bypass — 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation absent), (2) CAPTCHA token replayed from a solved challenge (no single-use enforcement), (3) CAPTCHA response accepted on a different endpoint than it was solved on (no binding to action/session), (4) static or predictable CAPTCHA values accepted (e.g. '0', 'null', empty string), (5) audio/accessibility CAPTCHA trivially solvable programmatically, (6) CAPTCHA only enforced after N
Passed 19 of 22 test cases with the skill, and 14 of 22 without it.
and 5 more in the full report
6 fixed13 passed either way2 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
A middleware tracks incoming HTTP requests using a sliding-window counter requiring 10 hits within 20 seconds to trigger anti-automation logic. Sequential automated requests spread across 2 minutes fail to hit the window. How should the request execution structure be adjusted?
| Checked | Without skill | With skill |
|---|---|---|
| Executes requests concurrently to arrive simultaneously within the sliding window | Missed | Passed |
The instructions your model reads when the skill loads.
The fastest test: just omit the CAPTCHA field entirely. Most CAPTCHA bypass bugs are client-side-only validation.
Pattern 1 — Omit the CAPTCHA field (most common, most automatable):
g-recaptcha-response, captcha, captcha_token, captcha_answer, h-captcha-response)Pattern 2 — Empty or null CAPTCHA value:
Instead of omitting the field entirely, include it with an empty string, null, 0, or undefined:
captcha=&[email protected]&password=test123
Some apps validate field presence but not content.
Pattern 3 — Replay a previously solved CAPTCHA token:
g-recaptcha-response tokenPattern 4 — Test without CAPTCHA on similar endpoints:
Some apps add CAPTCHA to the registration form but forget the password reset, API endpoint, or mobile API path (/api/register vs /register). Try the same action via the API path without any CAPTCHA field.
Pattern 5 — Rate/throughput-gated "prove you're automated" challenges: Some apps define CAPTCHA "bypass" as simply exceeding the rate a human could plausibly sustain — e.g. "N submissions within T seconds" — checked by a middleware that counts REQUESTS REACHING the route, not successful outcomes. Garbage/placeholder payloads satisfy this exactly as well as valid ones, since the counter increments regardless of whether the request's own validation passes.
Timing note (sliding-window counters): don't solve this one request at a time — a sequential
pace (seconds between each request) structurally cannot land N requests inside a short sliding
window, and issuing more requests serially does not fix it. A typical failing pattern is 12
requests spread across ~250 seconds when the check requires ~10 requests within 20 seconds.
Instead fire the requests concurrently (e.g. "concurrency": N on a single request call, or
any parallel-request primitive your tooling offers, with N >= the required count) so they arrive
simultaneously and satisfy the sliding window trivially. Check the endpoint's own
required-field validation first (e.g. a rating field that can't be null) so the concurrent
test cases passed, vs 14 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.