Exploiting Vulnerabilities in Weak CAPTCHA Mechanisms within DVWA

This research focuses on identifying vulnerabilities in the CAPTCHA implementation of the Damn Vulnerable Web Application (DVWA). We utilize Optical Character Recognition (OCR) with Tesseract, capture internet traffic using OWASP ZAP, and develop Python-based automated scripts to bypass substandard CAPTCHA implementations. Throughout the study, we uncover critical vulnerabilities, including the lack of CAPTCHA verification for sensitive actions such as password changes. We provide a detailed step-by-step analysis of how attackers can exploit these vulnerabilities. We conclude by comparing these weak CAPTCHA methods with more robust alternatives, such as Google reCAPTCHA, and recommend best practices, including server-side validation, CAPTCHA obfuscation, and the implementation of multi-layered security systems. The research employs software tools including Tesseract OCR v5.3, OWASP ZAP 2.12.0, Python 3.10, and DVWA 1.10 on XAMPP.