$ show elyelysiox/recaptcha
This repository serves as a technical deep-dive into Google's reCAPTCHA system, particularly focusing on its obfuscation techniques, fingerprinting mechanisms, and anti-tampering measures. It includes extracted JavaScript snippets that implement specific browser fingerprinting signals (e.g., storage access checks, window opener properties, WebGL data extraction) and JSON files containing example fingerprint data. The repository also contains analysis of the now-removed BotGuard component, including its obfuscated virtual machine implementations. While the subject matter is largely historical due to the removal of BotGuard in April 2026, the repository provides valuable insights into the techniques used by advanced anti-bot systems.
The LLM identified 4 files worth highlighting for reuse:
Implements a check for the browser's Storage Access API, returning a boolean indicating whether the document has storage access. Includes a fallback to cookie-based detection for browsers without the API. Demonstrates isolated feature detection for browser capabilities.
Analyzes the window.opener property to detect potential tabnabbing vulnerabilities or abnormal opener behavior. Returns an object with flags indicating if the opener is closed, inaccessible, or has been manipulated. Demonstrates a self-contained security-related fingerprint.
Extracts WebGL renderer and vendor strings, and checks for the presence of specific WebGL extensions. Returns an object containing this graphics hardware information. Demonstrates isolated harvesting of WebGL-based fingerprinting data.
Scans the visible text of the page for a predefined list of error-related keywords (e.g., 'error', 'failed', 'invalid') and returns a count of matches. Demonstrates a simple but effective technique for inferring page state or user experience issues via keyword frequency.