captchaforge 0.2.39

Captcha detection and solving for Firefox and BiDi-driven browsers. Detection, vendor solver scaffolding, trusted cross-origin click delivery into nested OOPIFs, and stealth personas are implemented and tested; broad live-vendor solve rates are not yet benchmarked.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

# tests/vendors/hcaptcha.toml: Per-vendor 10-test-type contract.

[vendor]
name = "hcaptcha"
display_name = "hCaptcha"
captcha_type = "hcaptcha"
api_url = "https://js.hcaptcha.com/1/api.js"
public_test_sitekeys = [
  { kind = "autopass", key = "10000000-ffff-ffff-ffff-000000000001" },
  { kind = "block", key = "20000000-ffff-ffff-ffff-000000000002" },
]

[positives]
# hCaptcha oracle: min_len=80, entropy >= 4.5 bits/byte. High-
# entropy base64url segments mimic the real JWT-shape token.
sample_tokens = [
  "P0_eyJhbGciOiJIUzUxMiJ9.eyJ0eXAiOiJDIiwiZXhwIjo5OTk5OTk5OTk5fQ.aB3xY7zQ9mK2wL5jH8nR4pT6vC1dF0gN-8eXqM7lJ4kS",
  "P1_eyJhbGciOiJSUzI1NiJ9.zM7nQ4kL1jH8pR5tV2wY9xC6dF3gN0eM7lJ4kS1aZbY8cV5uI2oP9rQ.6tW3nB0mE7sD4xL1kJ8hG5fR2qV9yU6cP3aB0eX",
]

[negatives]
decoy_tokens = [
  "",
  "DUMMY",
  "ok",
  "X",
  "TEST_FAKE",
]

[evasions]
inputs = [
  { token = "P0_", classify = "decoy" },
  { token = "P1_<script>", classify = "decoy" },
  { token = "P0_eyJhbGciOiJIUzUxMiJ9.eyJ0eXAiOiJDIiwiZXhwIjo5OTk5OTk5OTk5fQ.aB3xY7zQ9mK2wL5jH8nR4pT6vC1dF0gN-8eXqM7lJ4kS", classify = "plausible" },
]

[cross_file]
scenario = "token_capture_and_replay"

[cve_replay]
cases = [
  { id = "HCAPTCHA-EMPTY-PASS-2024", description = "Empty token claimed as success", token = "", expect = "decoy" },
  { id = "HCAPTCHA-NOPREFIX-2024", description = "JWT-shaped but missing P0_/P1_ prefix", token = "eyJhbGciOiJIUzUxMiJ9.eyJ0eXAiOiJDIn0.aaaaaaaaaaaa", expect = "decoy" },
]

[property]
min_length_for_plausible = 30
runs = 10000

[differential]
agreement_target = 0.95
[[differential.consensus]]
token = "P0_eyJhbGciOiJIUzUxMiJ9.aB3xY7zQ9mK2wL5jH8nR4pT6vC1dF0gN-8eXqM7lJ4kS.zM7nQ4kL1jH8pR5tV2wY9xC6dF"
verdict = "plausible"
[[differential.consensus]]
token = "ok"
verdict = "decoy"

[perf]
budget_us_per_classify = 10.0
budget_us_per_solve_path = 500000.0

[scale]
batch_size = 100000
budget_seconds = 5.0

[e2e_cli]
detector_class = "HCaptcha"
expected_solve_methods = ["BehavioralBypass", "AutoPass", "WaitForToken", "AudioBypass"]
forbidden_methods = []