ORIGINAL REDDIT POST
Pen-testing for form
I'm messing around with different kinda of captchas. Is there a way I can test their effectivness? It's just a form with one field, and an invisable captcha. I own the form, and the server it's on. Ideally there would be a program the works like a bot. Though…
I'm messing around with different kinda of captchas. Is there a way I can test their effectivness? It's just a form with one field, and an invisable captcha. I own the form, and the server it's on. Ideally there would be a program the works like a bot. Though I can understand why a legit version would be hard to find.
Collected discussion
if you own the server and form then just write your own bot to test it. some simple python script with requests library can spam submissions at your endpoint and you see what gets through. the invisible ones usually work by tracking mouse movement and time spent on page so your bot need to simulate that a bit
I know it works with emulating form submission. If JavaScript is off, no form submission will work. The captcha I am testing uses POW. But I don't know how to write code that can run the JavaScript
That's not how it works, forms can always still be submitted with JS disabled.
Check r/webscraping - they do such things
You are wrong, because tools, like Playwright execute JS on page without any issues. So while it can protect you from some bots that just take html page and send some http request to your form endpoint it will be nowhere near close to full protection against bots
Yeah, if you want to test captcha effectiveness, you could try using Selenium to automate form submissions. It's pretty handy for simulating bot behavior and seeing if your captcha holds up. Just set up a few scripts to mimic different submission patterns. It's all about findding the balance between bot defense and user experience.
Just get claude to read the altcha source code and you'll have a functioning bot in no time: https://github.com/altcha-org/altcha Altcha simply slows bots down, it doesn't block them based on behavioural data or intent.