Cracking reCAPTCHA, Turbo Intruder style
Summary: PortSwigger researcher James Kettle found that a reCAPTCHA solution token can be reused several times if requests are sent fast enough, using a new Turbo Intruder last-byte synchronization feature that cut the gap between requests to 0.7ms. Google declined to fix the issue, saying it did not think the attack was plausible in the wild, so PortSwigger patched its own site and disclosed publicly, demonstrating the attack against Reddit's registration process.
Why it matters: Each solved captcha can yield three times as many spam accounts, and on sites where reCAPTCHA guards thread-unsafe code, the same trick may open race conditions in reviews or voting - with the patching burden left on every site using reCAPTCHA rather than on Google.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026