ReCaptcha Callback Function

noellarkin · Oct 17, 2021

I've been writing a script for Recaptcha solving, using https://2captcha.com/2captcha-api#recaptchav2new_get as a guide.
I've already been able to:
1. Get Recaptcha sitekey from source
2. Send sitekey to DeathByCaptcha service
3. Poll DBC until I get a JSON object back containing the recaptcha key
4. Set key value in "g-recaptcha-response"

I'm stuck on the last step - submitting the recaptcha. The site I'm testing this on doesn't have a submit button ie this:

The documentation says a "callback function" is used in some sites instead of a submit button:

I ran ___grecaptcha_cfg.clients[0] in my browser console and I'm getting this:

But when I try to run ___grecaptcha_cfg.clients[0].aa.l.callback I get this:

So...um..where to from here? lol

bladee4r · Oct 17, 2021

I was rlly stuck on this exact thing a few weeks ago, then I solved it. Are you using Python requests? I can help.

noellarkin · Oct 17, 2021

bladee4r said:
I was rlly stuck on this exact thing a few weeks ago, then I solved it. Are you using Python requests? I can help.

Nope, AutoIT, but would be great to hear how you solved it, I'll try to adapt it to AutoIT.

bladee4r · Oct 17, 2021

In python requests, there is a hidden post request that submits the captcha. I didn't realize this, and thought that that text box needed to be filled in with the key value, which is impossible to do with requests, therefore I was stuck. But it turns out google only requires EITHER:
That text box to be filled with the key value then "submit" (a process completed by javascript for a normal person)
OR
that post request with the necessary parameters needed to be called. And the parameters for that request included the key value and a few other parameters that were site-specific.
I haven't used AutoIT so I can't tell if this is helpful to you or not, sorry.

noellarkin · Oct 17, 2021

bladee4r said:
In python requests, there is a hidden post request that submits the captcha. I didn't realize this, and thought that that text box needed to be filled in with the key value, which is impossible to do with requests, therefore I was stuck. But it turns out google only requires EITHER:
That text box to be filled with the key value then "submit" (a process completed by javascript for a normal person)
OR
that post request with the necessary parameters needed to be called. And the parameters for that request included the key value and a few other parameters that were site-specific.
I haven't used AutoIT so I can't tell if this is helpful to you or not, sorry.

Thanks. I'm not sure if I can parse what your saying into AutoIt but I'm going to spend a couple hours on it and see if it can be done.

bladee4r · Oct 17, 2021

noellarkin said:
Thanks. I'm not sure if I can parse what your saying into AutoIt but I'm going to spend a couple hours on it and see if it can be done.

In AutoIT, is there a way to execute javascript / scripts in the console of the browser?
If so, I think I have a solution for you

noellarkin · Oct 17, 2021

bladee4r said:
In AutoIT, is there a way to execute javascript / scripts in the console of the browser?
If so, I think I have a solution for you

yep that's exactly what I've been doing so far

What JS can I paste into the console?

bladee4r · Oct 17, 2021

document.getElementById("g-recaptcha-response").innerHTML="token";
I used this for my situation, but I had a submit button, and therefore it didn't work because the submit button needed to be pressed as well.
Maybe this will work in your situation without the submit button?
Or, is there some other HTML value that changes upon solving the Captcha by hand?
If I were you, if the script above doesn't work, I would manually solve the captcha and watch for any changes with the HTML elements that are involved with the captcha, and then try a similar script above to see if changing them does something.

noellarkin · Oct 17, 2021

bladee4r said:
document.getElementById("g-recaptcha-response").innerHTML="token";
I used this for my situation, but I had a submit button, and therefore it didn't work because the submit button needed to be pressed as well.
Maybe this will work in your situation without the submit button?
Or, is there some other HTML value that changes upon solving the Captcha by hand?
If I were you, if the script above doesn't work, I would manually solve the captcha and watch for any changes with the HTML elements that are involved with the captcha, and then try a similar script above to see if changing them does something.

Well I did the innerHTML thing as well. I injected that exact same snippet you posted into the console. I'm not getting a SUBMIT button - - according to the 2Captcha API documentation, some sites don't have a submit button, and for those sites one needs a "Callback function".

Yeah I guess I'll have to manually solve it and see if there are any HTML changes. Thanks for the help.

bladee4r · Oct 17, 2021

noellarkin said:
Well I did the innerHTML thing as well. I injected that exact same snippet you posted into the console. I'm not getting a SUBMIT button - - according to the 2Captcha API documentation, some sites don't have a submit button, and for those sites one needs a "Callback function".

Yeah I guess I'll have to manually solve it and see if there are any HTML changes. Thanks for the help.

Really sorry, this frustrated me a lot too. There seems to be one element going on that both of us don't understand, but the creators of the captcha service do. It is solveable. Please keep me updated

noellarkin · Oct 17, 2021

bladee4r said:
Really sorry, this frustrated me a lot too. There seems to be one element going on that both of us don't understand, but the creators of the captcha service do. It is solveable. Please keep me updated

Yep, will do. Planning on badgering the 2Captcha and DBC guys until I crack this

rjss7 · Oct 18, 2021

Hi there,

It's been a while since I've used the DBC api, but I will follow this threat and I hope I can help.
Isn't it working to submit the complete <form> using javascript after setting the g-recaptcha-response?

document.getElementById('theForm').submit();

noellarkin · Oct 18, 2021

@rjss7 Thanks for responding

well the issue isn't submitting the Form, it's submitting the recaptcha to Google after setting g-recaptcha-response. The 'submit' button I'm taking about is the Recaptcha submit, which happens prior to the form submit. I need to find the name of the callback function and run that in the console before submitting the form.

I was looking at the Firefox Recaptcha plugin and here's the code snippet that deals with callback functions:

JavaScript:

function bitir(code)
{   
    var taskSolution=code;
    var injectedCode = "(" + function(taskSolution) {
                    var recaptchaCallbackAlreadyFired = false;
                    
                    var recursiveCallbackSearch = function(object, solution, currentDepth, maxDepth) {
                        if (recaptchaCallbackAlreadyFired) {
                            return
                        }
                        var passedProperties = 0;
                        for (var i in object) {
                            passedProperties++;
                            if (passedProperties > 15) {
                                break
                            }
                            try {
                                if (typeof object[i] == "object" && currentDepth <= maxDepth) {
                                    recursiveCallbackSearch(object[i], solution, currentDepth + 1, maxDepth)
                                } else if (i == "callback") {
                                    if (typeof object[i] == "function") {
                                        recaptchaCallbackAlreadyFired = true;
                                        object[i](solution)
                                    } else if (typeof object[i] == "string" && typeof window[object[i]] == "function") {
                                        recaptchaCallbackAlreadyFired = true;
                                        window[object[i]](solution)
                                    }
                                    return
                                }
                            } catch (e) {}
                        }
                    };
                    
                    if (!recaptchaCallbackAlreadyFired) {
                        if (typeof ___grecaptcha_cfg != "undefined" && typeof ___grecaptcha_cfg.clients != "undefined") {
                            var oneVisibleRecaptchaClientKey = null;
                            visible_recaptcha_element_search_loop: for (var i in ___grecaptcha_cfg.clients) {
                                for (var j in ___grecaptcha_cfg.clients[i]) {
                                    if (___grecaptcha_cfg.clients[i][j] && typeof ___grecaptcha_cfg.clients[i][j].nodeName == "string" && typeof ___grecaptcha_cfg.clients[i][j].innerHTML == "string" && typeof ___grecaptcha_cfg.clients[i][j].innerHTML.indexOf("iframe") != -1) {
                                        if (___grecaptcha_cfg.clients[i][j].offsetHeight != 0 || ___grecaptcha_cfg.clients[i][j].childNodes.length && ___grecaptcha_cfg.clients[i][j].childNodes[0].offsetHeight != 0 || ___grecaptcha_cfg.clients[i][j].dataset.size == "invisible") {
                                            if (oneVisibleRecaptchaClientKey === null) {
                                                oneVisibleRecaptchaClientKey = i;
                                                break
                                            } else {
                                                oneVisibleRecaptchaClientKey = null;
                                                break visible_recaptcha_element_search_loop
                                            }
                                        }
                                    }
                                }
                            }
                            if (oneVisibleRecaptchaClientKey !== null) {
                                recursiveCallbackSearch(___grecaptcha_cfg.clients[oneVisibleRecaptchaClientKey], taskSolution, 1, 2)
                            }
                        }
                    }
                } + ')("' + taskSolution + '");';
                var script = document.createElement("script");
                script.textContent = injectedCode;
                (document.head || document.documentElement).appendChild(script);
                script.remove();
}

PS: Regarding the plugin I'm referring to that has a callback function built it, it's "Recaptcha Solver".
Here's the plugin in case you haven't used it: https://addons.mozilla.org/en-US/firefox/addon/recaptcha-solver/
To access the script, right click and download the xpi file, unzip it, and open content/main.js

batmax · Sep 30, 2022

The captcha call back function is not always the same.
You need to find the good argument for yours:
in your target page, go to console and type :
___grecaptcha_cfg.clients
you'll find differents arguments then you have to pick the wrigth one (with a callback function)

In my example its in ___grecaptcha_cfg.clients[0]['O']['O'].callback(YOURRESPONSE)

becarefull it can change !!

ReCaptcha Callback Function

noellarkin

Senior Member

bladee4r

Regular Member

noellarkin

Senior Member

bladee4r

Regular Member

noellarkin

Senior Member

bladee4r

Regular Member

noellarkin

Senior Member

bladee4r

Regular Member

noellarkin

Senior Member

bladee4r

Regular Member

noellarkin

Senior Member

rjss7

Registered Member

noellarkin

Senior Member

batmax

Registered Member

Main Menu

Marketplace

Making Money

BlackHat World