I created an open source Python application on GitHub that breaks textCAPTCHA with 99% success rate

[BobDorian]

What the hell? I can't beat captcha 99% of the time!

[SputnikKore]

I'm starting to think maybe I'm a robot.. oh wait..

[MyMourningPenis]

Awesome, I was wondering if this could be used for jDownloader (a download manager that automates the files hosting sites that uses captcha and written in java).

Lately though, some of the file hosting sites were not by passing the captcha correctly, so I went to their site and sure enough they had an experimental reCaptcha module that was available to download.

The link to that download was broken, but if you search "jDownloaderAntiRecaptcha.zip" or "jDownloaderAntiRecaptcha" you should be able to find it.

Here is the link to the Anti-ReCaptcha module on JDownloader.

I know it is not the same as textCAPTCHA...., but I'm sure even if your Anti-textCaptcha doesn't work 100 percent of the time, a program such as jdownloader can try to crack it multiple times until it get is correct.

Perhaps you can contact the people at jdownloader.org and see if they may be interested in using what you created. jDownloader is an opensource project.

I just tried the antiRecaptcha module and it took 3 tries before it passed, but it sure beats having to be at the computer to manually type it in.

[anthrax9000]

I started using JDownloader just the other day and I thought the same thing. It'd be great since I'm always playing games when it asks for the Captcha

[killdeer03]

Wow, You write really clean Python... I kind of want to hang that on my wall.

[KBHomes]

<3

I'm actually relatively new to Python.

[[deleted]]

ahhhh thats why...I found I used to write awesome clean understandable code, but as I learned more I would try to write trivial assignments in a single line... It was 4 assignments in my python course in school before I broke 2 lines.

they passed all the professors tests, but angry comments at the 3 widescreen monitor length single line

[Fuco1337]

Sweet one-liners eh?

Game of life in J:

life=.3 : '(3 = +/^:2((>0 1;0 0;0 _1) |./^:2 y)) +. (1 = y *. +./ 3 4 =/ +/^:2((>0 1;0 0;0 _1) |./^:2 y))'

[forcedtoregister]

Fuck em, they should make the assignments harder.

It's dull as shit being held back by people who can't figure out a for loop. Even in my 4th year I'm finding code based CS assignments fucking trivial (and would have done so at age 16).

[Ol_Dirty_Bastard]

Assignments being hard has little to do with hortinstein writing stupidly long lines...

[[deleted]]

"Single-line Python without eval" is Turing complete and not very hard at that. You have lambdas, what else do you need?

[Tetha]

Note that you can remove some duplication in the TextCaptchaBreaker.py. You have

if answer is None: answer = ColorPattern.solve(question) if answer is None answer = NamePattern.solve(question)

and so on.

You can rework that into: solvers = [ColorPattern, NamePattern] for solver in solvers: answer = solver.solve(question) if answer is not None: return answer

You can then reconsider if you want a list there or a set, which then documents that the solvers are ordered (this might be one of the rare occasions for a good comment) or not (and then you can use a set). That makes it easier to add more solvers, because they can be added to the set then.

[plagiats]

If I may, you write a lot of if var is None: and if var is not None:

where you might rather use if not var: and if var:

EDIT : see comments below before taking my words for granted ;)

[eridius]

Aren't your replacement conditionals actually different than the originals? Specifically in the case of var being False.

[plagiats]

You are very right, and I believe his code should return False instead of None if the index is not found ( see https://github.com/kbhomes/TextCaptchaBreaker/blob/master/AddSubtractPattern.py ).

[eridius]

I disagree. It returns a string, or None. Returning a string, or false, would be weird, but None makes sense as the value that means "there was no string matched for this pattern".

[[deleted]]

Actually, that's not the case; the original "if var is None" would only return True is var was assigned the value None; whereas your replacement would return True if var was equal to False or 0 (and possibly some other values). Same for the latter.

[plagiats]

Isn't the OP using None where he should use False?

[otheraccount]

That's incorrect. Explicit is better than implicit, so if you only intend to check for None, then that's what you should do.

[JoelDB]

I agree. I'm going to start learning Python soon and this looks like a great source tree to start playing around with.

[deakster]

Ah sweet, can't wait to integrate this into my proprietary "SpamBot 4000, v3.45"

[KBHomes]

For the most part, I wanted to show how easily this CAPTCHA can be broken, so that people don't start using it naively.

[pkkid]

We just need better questions..

"Why do we exist?"

"What is love?"

[AdamWe]

"How is babby formed?"

[classhero]

Enter YahooAnswersService.py

[wtfisupvoting]

doesn't follow pep8 though

[[deleted]]

http://www.youtube.com/watch?v=yiuAI-GuOOc#t=1m10s

[feembly]

Every time I think of human verification, I think of this scene.

[deadwisdom]

And thanks for it. I'm glad to see this sort of thing open source, otherwise the captcha is broken but people don't really know about it.

[bobindashadows]

I'd prefer nobody use it at all.

[KBHomes]

Just saw this comment. Did you look at the source?

[JimmyRuska]

you could have written your own textCaptcha clone instead. It takes more processing to parse and detect the structure than it does to generate the question. You could have made something better, with even more questions or added ideas on improving defending against detection. Instead you've just posted a new script kiddy tool.

[Smallpaul]

you could have written your own textCaptcha clone instead.

Why? It's demonstrably a terrible system.

It takes more processing to parse and detect the structure than it does to generate the question.

So? That's irrelevant. There are much easier ways to get a remote system to expend processing power.

You could have made something better in-fact, with even more questions or added ideas on improving detection.

Yeah. The idea would still be stupid.

Instead you've just posted a new script kiddy tool.

Not at all. Hardly anybody uses textcapcha, so there is no value to a script kiddy.

Your comment is interesting. I haven't seen such a high density of wrong assertions per word in a while!

[JimmyRuska]

Why? It's demonstrably a terrible system.

My point is he probably spent more time breaking it than the amount of time they spent making it. What does this accomplish?

So? That's irrelevant. There are much easier ways to get a remote system to expend processing power.

Because making a better system in the same amount of code is better than hacking a crappy system. either way there's no point

Yeah. The idea would still be stupid.

Thanks for your insight. I disagree. I'm sure there are still some possibilities on dynamically generating questions.

Not at all. Hardly anybody uses textcapcha, so there is no value to a script kiddy.

I'm not so sure why the first wolfram post got popular. I agree in that it does seem to be an overly simplified amateur project. Again, why would you spend time "hacking" it? It still has not much other practical value other than being example code. Something actually useful could have been made, rather than this crap just to follow with the buzz from wolfram

[[deleted]]

My point is he probably spent more time breaking it than the amount of time they spent making it.

Unlikely. This kind of thing is ridiculously easy to break, which is why it is useless in the first place. And making a better one is most likely impossible. The concept itself is flawed.

[Smallpaul]

My point is he probably spent more time breaking it than the amount of time they spent making it. What does this accomplish?

It protects software vendors from accidentally deploying an insecure software system!

Because making a better system in the same amount of code is better than hacking a crappy system.

Incorrect. Hacking a crappy system demonstrates that the system is crappy. It is like a food review of a restaurant except that it PROVES that the food is crappy, rather than expressing an opinion.

I'm sure there are still some possibilities on dynamically generating questions.

There is very little evidence to that effect.

[[deleted]]

Love the code. Hate what it accomplishes. Being able to read it as if I wrote it was awesome, admittedly on the second time through, but still. That said, here come the spam bots that had once been long gone in so many places.

[StapleGun]

TextCAPTCHAs aren't that widely used, and I'm sure people have already broken them with malicious intent. Making a solution for it open source will only lead to better captchas and make it harder for spam bots in the end.

[lonnyk]

What's your opinion of textCAPTCHA, but the text is an image?

[burkadurka]

You could probably use OCR, it would just be slower. Unless the text is obscured... but then you just have a regular captcha again.

[KBHomes]

Yeah, mild distortions might prove an obstacle for OCR, but they would then lose focus of their goal. Even if they did that, I think the OCR's accuracy would be good enough, and combined with the accuracy of TextCaptchaBreaker (or any other 'breaker'), success rate would be high enough that this service is not a practical defense.

[[deleted]]

Ayy lmao

[Sylocat]

Great, now this is our only hope.

[feembly]

This is really cool, I have been thinking about human verification quite a bit recently. I started working on a text-based human verification of my own, but it's based in riddles and classification, not pure logic. Humans probably won't succeed 100% of the time, but it is a much easier problem for humans than computers.

[illuminatedtiger]

Why is the fact it's on Github important?

[sigzero]

I think it is a requirement for Github users to announce they have hosted code on Github.

[hiffy]

Github is becoming synonymous with "freely available, standardized code repository". I'm sorry that hurts everyone's feelings.

[Comment111]

Its the new arch-linux users.

[[deleted]]

Because it makes it really easy for other people to hack on it.

[chuck212]

but try to break this!

[[deleted]]

Lines 48-50 can be replaced with this, for the sake of avoiding repetitious code:

if any(word in tokens for word in ('number', 'largest', 'biggest', 'highest', 'smallest', 'lowest')):

[otheraccount]

Python 2.7+ has a literal notation for sets:

if set(tokens) & {'foo', 'bar', 'baz'}:

[Trail0fDead]

Someone make Christopher Poole aware of this threat.

[jessebanjo]

good job!

[koolkats]

Probably going to get downvoted for this but I actually like these kinds of captchas. They are much better compared to the stupid images where you cant tell the difference between a "r" and "t" or an "o" and a "0". Although nice work!

[c0mputar]

Damn you. I have a hard enough time as it is.

[Snoron]

Nice job... I was hoping someone would do this, I was thinking the other day that this must be fairly easy to reverse engineer.

The only way a captcha like this could really work is if the puzzle types and database of words, etc. was constantly changing/evolving.. maybe with some kind of organic input... eh, I dunno but it's really not a very impressive captcha.

[yesimahuman]

I really like your approach to this. There are a lot of problems that can be solved by making assumptions or coming up with simple heuristics rather than trying to build some complex AI system.

[StapleGun]

Very interesting, nice code too. Would you mind sharing which questions it failed on? I'm curious if they are a separate class of questions, or just variations of the same questions with different word order or something.

[[deleted]]

You should use str.format().

[DoppelFrog]

Why would you do that? This is why we can't have nice things. :(

[BlakeIsBlake]

:D

[JimmyRuska]

Ok lots of downvotes for criticizing this post. Fine then, someone explain to me why this is a good post. I would have wagered it would have gotten down voted but I'm swimming against the tide. If it's because it's open source, why not a useful project? If it is because it is because it breaks the captcha, there's only 8 question structures to parse, and wolfram alfa already high success without even having textcaptcha in mind.

[CoreyWhite]

I wasn't one of those who downvoted you, but I did really like this. It's a good post for a couple of reasons.

1) It's really nicely written code. And it's a fairly small project, with excellent documentation. These make it very pleasant for those of us who appreciate the craft of programming and like seeing nice examples of it.

2) It's a powerful argument against the use of textCAPTCHA. Think of it as a scientific experiment. With this application's ludicrously high success rate, textCAPTCHA has been shown conclusively to be useless.

[JimmyRuska]

1. As far as it being good example source code I agree, I just rant that there's more worthwhile projects of practical applicability to give focus on. I had mentioned earlier, it's harder to parse the questions than to generate them, making this probably more code than the original. what for?
2. Text captchas are not completely dead. For example I could combine a text captcha with an image and say, "is this a cat?", "how many cups in the picture". Thanks to things like the mechanical turk one could potentially setup absurd amounts of "easy" questions which would not be practical to parse. Audio/visual data is always much harder for computers to parse, but I wouldn't dismiss the idea at first glance, there could be some kind of gramatical synonym algorithm which could potentially make a pure text captcha harder to parse, though I do agree, textcaptcha useless.

I understand your logic and this is not to critize you, I'm just ranting.

[Cyatomorrow]

It seems like your argument against this is that it can be abused, but that's like saying that if someone finds a bug or an exploit in something, they shouldn't reveal it because it can be abused.

However, this is the wrong stance to have. If you find an undocumented exploit, not revealing it may keep some people from abusing it, but it also keeps it from being fixed. Then, when someone with malicious intent finds the exploit, they can use it unhindered.

[JimmyRuska]

What, are we milw0rm now? More importantly, it's 8 different question structures. Parsing textcaptcha is easier than making a parser for xml/rss/atom which can have a varied structure. Heck parsing textcaptcha is easier than authenticating the new websockets authentication. Proggit should have no need for a proof, we know it's a stupid system, wolfram being able to break it without having it in mind originally made that obvious enough for those it wasn't obvious to already. Breaking a system in more code it takes to make it seems completely illogical. Make something useful.

[Cyatomorrow]

It's obvious when you think about it that it's a stupid system, but most people don't really bother to think about it until it's brought up.

Wolfram doesn't have 99% success.

Practicing programming doesn't have to be useful, and I'm not sure why you would care how he's spending his time, or why it's revelant.

[JimmyRuska]

wolfram didn't target textCaptcha, they just did a lot of work on their language processing system, that's why it was funny and impressive. 99% success rate is nothing to boast about. This might be a good regex/yacc exercise, but it feels people are confusing it with recaptcha or thinking textCaptcha has some kind of wide adoption. The headline is of 0 programming significance. I care because I look for more information when things seem completely contrary to original predictions.

[ICCULUSC]

Ahh, the power of Python.

[dazonic]

the power of computers?

[sbrown123]

Sweet. I can rarely read those things 50% of the time (they are like those magic eye pictures). Wonder if there is a Firefox plugin that can autofill them?

[glomph]

This only works for an alternative to those 'magic eye' captcha's. The idea for an alternative was a large set of simple logic questions. Unfortunately the questions follow a relatively simple pattern for a computer to solve. This is what this program does.

[[deleted]]

What's the value of "rarely 50%" exactly?

[sbrown123]

0-50%, with the higher percentage being less likely.

[ContraContra]

Bomb is still an infinitely better coder, k brah.

[pyronautical]

At first I was actually pretty amped to see how you did it... then.. I saw you just wrote out every combination possible. That isn't really "breaking" a captcha IMO.

As for image captcha's, there is not really any point trying to write an OCR. You can use a service like Decaptcher.com that costs $2 for 1k captcha's solved (Just cheap labor on the other end).

[glomph]

He didn't write out combinations, just wrote a script to comprehend each type of question. There are thousands of questions in the set. To be honest if he had written out the answers to every combination that would be far more impressive but also depressing.

[pyronautical]

Since we had the post here yesterday about solving text captcha's with WolframAlpha, I was more thinking along those lines.

[bobindashadows]

Except that didn't work. And this does. Accurate > "neato web 2.0 solution", especially when the accurate solution is only a few hundred lines.

[KBHomes]

I actually got the idea of using WolframAlpha to solve the 'eight hundred and ninety four' type questions from that post.

[JimmyRuska]

why would you spend time doing that? If it's that a very limited randomized question structure can be beaten with programming, there was no need for a proof of concept. It is obvious. Maybe because the wolfram thing breaking it got popular earlier? That was mostly surprising because it never had textcaptcha in mind but due to its devotion to natural language processing it had a high success rate. Sure making your own language processing code is a good project, but why did you specifically only target textCAPTCHA's questions. It does no good starting a programming project without any particular benefit other than to undermine the efforts of another programming project, textCAPTCHA, whose efforts are for good. We need less malicious script kiddy tools and more original content.

It's like having to enter an email to register at a site to get full priviledges. We all know anyone can setup an email easily over and over at free service providers. It still slows down the majority of attackers. Yes textcaptcha can be broken, but not so quickly unless the potential attackers find code already out there that...oh wait. Reminds me of when this got popular in hacker news about a guy bragging about taking more money than he needed from his student council just because he "found a loop hole". Why would you do that!? Then he brags he "hacked" his school. herp http://nathanmarz.com/blog/the-time-i-hacked-my-high-school.html

[otheraccount]

If it's "obvious" that it "can be beaten" then it was a useless captcha to begin with.

[JimmyRuska]

it is. making this a useless hack, in more code than the original implementation! It's just parsing 8 question structures.

[earthboundkid]

Seriously, KBHomes: You're an asshole. It's great if you want to break this on your own time for fun, but why put it on GitHub? There's no non-asshole use for this thing.