Break the Recaptcha - Nightmare


Break the Recaptcha - Nightmare


This challenge is very similar to the previous 'Break the Recaptcha' challenge, with a little twist.

In this case, after trying to log in incorrectly for 3 times, the server would reply with 'Your IP Address has been locked for one hour!', even when we 'spoofed' the captcha correctly.

This simple brute-force protection meant that we could no longer use the previous solution, as 3 attempts per hour would simply take too long.

After a few unsuccessful attempts to find a flaw in the brute-force protection (such as spoofing the X-Forwarded-For header) we decided we truly need to attempt the logins from unique IP addresses.

For this we dumped a large list of free http proxies, and added the following code to the requests logic:

proxy_list = list(set(open('ProxyList.txt', 'rb').readlines()))
proxies = {'http': random.choice(proxy_list)} 
    s.get('', headers=headers, proxies=proxies, timeout=4)
except Exception:

This means each login attempt was performed using a different http proxy, and thus the challenge server saw it coming from a different IP address.

Note that we also added a timeout and an error handling mechanism, as many of these proxies are not very reliable.