English

A Low-Cost Attack against the hCaptcha System

Cryptography and Security 2022-03-08 v1

Abstract

CAPTCHAs are a defense mechanism to prevent malicious bot programs from abusing websites on the Internet. hCaptcha is a relatively new but emerging image CAPTCHA service. This paper presents an automated system that can break hCaptcha challenges with a high success rate. We evaluate our system against 270 hCaptcha challenges from live websites and demonstrate that it can solve them with 95.93% accuracy while taking only 18.76 seconds on average to crack a challenge. We run our attack from a docker instance with only 2GB memory (RAM), 3 CPUs, and no GPU devices, demonstrating that it requires minimal resources to launch a successful large-scale attack against the hCaptcha system.

Keywords

Cite

@article{arxiv.2104.04683,
  title  = {A Low-Cost Attack against the hCaptcha System},
  author = {Md Imran Hossen and Xiali Hei},
  journal= {arXiv preprint arXiv:2104.04683},
  year   = {2022}
}

Comments

To appear in the 15th IEEE Workshop on Offensive Technologies (WOOT 2021)

R2 v1 2026-06-24T01:01:50.420Z