clipcaptcha

clipcaptcha by Foundstone is an extensible and signature based CAPTCHA Provider impersonation tool based off Moxie Marlinspike's sslstrip codebase. Depending on its mode of operation it may approve, reject or forward the CAPTCHA verification requests. It maintains an easy to edit XML configuration file that it queries to identify CAPTCHA provider request formats and render corresponding responses.

Requirements:
Python 2.5 or newer
Twisted Python Module

Download clipcaptcha.

Running clipcaptcha:
Run 'python clipcaptcha.py -h' for help.

The four steps to getting this working on Linux are:

1. Enable forwarding mode on your machine
   echo "1" > /proc/sys/net/ipv4/ip_forward
2. Setup iptables to redirect HTTP traffic to clipcaptcha.
   iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port
3. Run arpspoof to redirect the traffic to your machine.
   arpspoof -i -t
4. Run clipcaptcha in one of its mode of operation.
   clipcaptcha.py -l

clipcaptcha can be run in one of the following five operational modes and selecting more than one operation mode is an error:

1. Monitor Mode: Signature based CAPTCHA provider detection is performed and all CAPTCHA validation requests are logged to a local file. The CAPTCHA validation requests and corresponding responses are allowed to complete without any modifications.
2. Avalanche Mode: Success response is returned on the matching CAPTCHA provider for all validation requests. It is recommended to not run clipcaptcha in this mode as a surge in successful account creation or registrations may be detected.
3. Stealth Mode: Stealth is the recommended mode for running clipcaptcha. This mode relies on the fact that all CAPTCHA validation API.s need to send user supplied CAPTCHA solution to the CAPTCHA providers for validation. clipcaptcha banks on this behavior to operate stealthily and return Success status only for the requests that contain a secret string. In its current implementation, clipcaptcha parses the entire CAPTCHA validation request (initial line, headers and body) and returns success if the secret string is found or allows the request to complete without any modifications.
4. DoS Mode: Failure response is returned for all CAPTCHA validation requests. This leads to a Denial of Service condition on the target web application for all forms that require CAPTCHA validation.
5. Random Mode: Random Success and Failure responses are returned as per the matching CAPTCHA provider for all validation requests and exits only as a teaser mode.

Once clipcaptcha instance starts running, all CAPTCHA validation requests will be administered by clipcaptcha.

Signature based CAPTCHA provider detection:
All CAPTCHA providers are basically HTTP based custom web services. These services accept CAPTCHA validation requests in a particular format and respond with finite set of responses that allow the clients to make Boolean choices to allow or disallow the request. clipcaptcha takes advantage of this finite and predictable request and response data set to implement signature based request detection and response system. For additional details please refer clipcaptcha whitepaper.

The default configuration contains signatures for reCAPTCHA, opencaptcha and captchator.

Example runs: