Automation and bypassing Google No CAPTCHA reCAPTCHA

Question

My client want to use Google's No CAPTCHA reCAPTCHA (NCRC) to prevent robots completing an application.

QA have automated this process, but if the business introduce NCRC into the form, then this will prevent QA from being able to automate the application.

Is anyone aware of a way around this, whilst keeping the same build in Live and QA? I'm hoping there's a 'test mode' we can switch on for QA, but I can't find anything in the documentation.

---

Edit / Solution: You can now automate reCAPTCHA v2, thanks to @Andrei Fierbinteanu for the link. This won't work on v1, so you need to upgrade. Just make sure you're using the correct keys in QA and Production.

Answer 1

Cleanest solution is to get it removed for QA environment (render it conditionally) - you have one right? You do test BEFORE deploying to production? So don't use CAPTCHA in environment where you run automated tests.

If you cannot, use automated humans: there are companies which will solve CAPTCHA for you - it is quite cheap, 1000 for a buck, with decent success rate, response within 15 secs. This of course will add complexity to your tests: your test need to submit CAPTCHA to vendor and get response.

Exactly same build in QA and in production, when production prevents automated scripts, allows for manual testing only in QA. Someone should start to think and re-evaluate dogmatic requirements.

What is the goal: blindly implement requirements (no questions asked), or create process which allows for productive development and testing.

Answer 2

In order to keep the same build for testing as production there needs to be some sort of toggle in the application. Preferable in a configuration file (or database setting). By default the useCaptcha setting is enabled, but in the test environment you disable this in the configuration file.

This means the code will have two paths

1. One that does not load the captcha at all and continues without it
2. One that displays the captcha and requires user input

Still you would need to manual test that it works without the configuration setting, but that only needs to be done once each release cycle.

Its up to the development team to help you make the application testable, this is common way for solving this challenge.

Answer 3

From what I understand, you have two options:

1. If it's a local instance of reCaptcha, then you can look up the image ID in the database to find the code it's tied to.
   • http://www.softwaretestingclub.com/forum/topics/how-to-break-recaptcha-using-selenium-webdriver?commentId=751045%3AComment%3A243339
2. Have your Dev install a backdoor. So that when a specific input is received the application does not post the result to Google's API but rather allows you to move on as if the response from the API call was successful.
   • https://stackoverflow.com/a/12667949/1106708

Answer 4

If this has to be the same copy you ship and you cannot modify it, you cannot test beyond the captcha. That is the reason of having captchas - to avoid automation.

So the only option is to build in something into your app that makes testing possible. This of course will pose the risk of getting out into the field and mess things up.

I only can imagine some ways of doing it without too much risk for live. According to the Google doc, your application still has to evaluate the result Google sends back, hence even with a false, you can permit the submit.

• permit a list of really good unique keys as solution and rotate them with each new build (such as 987asdhats6df87a6s87df87a6sdf)
• implement an OTP and because you and the app know the start seed and are synced, you can pass in valid parameters (http://en.wikipedia.org/wiki/One-time_password), no list has to be maintained, hence you can even test later on live again
• evaluate on which installation/in which environment the software runs and enable or disable to verification of the captcha challenge