Juice-shop: Create Stronger Captcha

[philly-vanilly]

The tier 5 captcha challenge (about making many requests ina few seconds) can currently be solved by simply executing cURL or Postman very quickly, because you can define the captchaId and answer to it yourself:

{"UserId":1,"captchaId":2,"captcha":"96","comment":"ur shop sux!!1","rating":1}

So why not move this challenge one or two levels down and make a more difficult Captcha? You could place it for example in the Recycling Form. It should not be simply replayable and would require utilizing an additional (self-written) tool.

Suggestion: making a clone of Google's "reCaptcha" but with fruit-images. Then a hacker would need to use image recognition like in this tutorial for example: https://www.youtube.com/watch?v=jRkW5Uf58K4 https://github.com/crazzle/pydata_berlin_2018

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[bkimminich]

Possible libraries to use

• https://www.npmjs.com/package/svg-captcha
• https://github.com/trekjs/captcha
  and others, see https://github.com/ZYSzys/awesome-captcha

None for image based CAPTCHA, though... 😔

[CaptainNick]

@bkimminich I would like to take up this issue.
I think image CAPTCHA's are possible too. also will not require much change in the existing code base.
Please checkout : https://www.npmjs.com/package/text2png

[CaptainFreak]

@philly-vanilly Really nice suggestion about the solution. It would bring a new flavour of offensive machine learning to Juice-shop. In the past, me and my friend had done similar kind of thing on an engagement.

@bkimminich Check this out. It's really fun.

“How I hacked 747 game 😎 || Built Cheat Bot using Deep Learning” by Shubham Sawant https://bit.ly/2Tnox6C

[bkimminich]

I guess the requirements for this ticket were never put here, they just happened in some Slack or Gitter discussion way back... so here's the overall idea:

• The simple math-question CAPTCHA in "Contact Us" stays just as it is
• The "Recycling" use case receives a separate, stronger CAPTCHA (e.g. text2png as introduced in #851)
• The CAPTCHA is not shown on first submitted Recycling request
• If the user submits another Recycling request within e.g. 5min the CAPTCHA is shown

[CaptainNick]

Sure :+1: @bkimminich. I will apply text2png for strong CAPTCHA on "Recycling" functionality.

[CaptainFreak]

For simple captchas like from "text2png". There is even no need to go to lengths of training and designing models.

Just python one liner is enough using tesseract package. :)

https://www.pyimagesearch.com/2017/07/10/using-tesseract-ocr-python/

[agrawalarpit14]

Hi @Nikita-Jr Please let me know if you are working on this. Otherwise I will be able to take it up.
Thank You!!

[supra08]

Hi @bkimminich, I would like to take up this issue to implement the CAPTCHA in the recycle form, if no one is working on it. It would be an exciting location to install new challenges IMO.

[CaptainNick]

Hi @agrawalarpit14 and @supra08 sorry for my late reply. Yes I'm working on this issue.

[bkimminich]

@aaryan01 and @agrawalarpit14 have implemented stronger CAPTCHA in Data Subject Export section now. We don't really need 3 CAPTCHAs, unless the third would be _neither_ based on math _nor_ on image distortion. Would have to be very different to be considered now.

[bkimminich]

@Nikita-Jr, sorry but you weren't posting any updates and didn't send a PR for 3 weeks.

[CaptainNick]

Okay, no issue. :+1:

[lock[bot]]

This thread has been automatically locked because it has not had recent activity after it was closed. :lock: Please open a new issue for regressions or related bugs.