How to audit CAPTCHA on a website

Question

Accepted Answer

To audit a website's CAPTCHA, one must first identify the specific CAPTCHA implementation, such as reCAPTCHA v2/v3, hCAPTCHA, or a custom solution, as each has unique characteristics and potential vulnerabilities. A crucial step involves performing a functional bypass assessment to determine if automated scripts can circumvent the challenge by directly submitting forms, manipulating session tokens, or exploiting API endpoints. Auditors should meticulously test various failure scenarios, including multiple incorrect attempts and rapid submissions, to check for effective rate limiting and robust error handling mechanisms that deter brute-force attacks. It is also essential to evaluate the CAPTCHA's accessibility and user experience, ensuring it doesn't unduly hinder legitimate users, especially those with disabilities, while still providing strong protection against bots. Finally, examine the server-side validation logic for any flaws, verifying that the CAPTCHA response is securely checked before processing sensitive actions and that no sensitive information is leaked through its operation.