43

Preface: my goal is not to solve captcha using automation tools, but to attempt to understand why a browser that is being launched by selenium is being identified as a bot in the first place, and how selenium contributes to this.

I use selenium to start up firefox and log onto a website to scrape some data a few times a day.

Recently the website changed their login system by adding google's reCAPTCHA, and everytime I try to click the checkbox, google determines that I am a bot and asks me to select a bunch of images.

I started up a regular instance of firefox (that is, without selenium), went to the website, clicked the checkbox, and it determined that I was a human and let me go.

I then became curious what was the difference between me launching firefox through the executable, and me launching firefox through selenium. I decided to launch firefox using this piece of java code

WebDriver driver = new FirefoxDriver(new FirefoxProfile());

So I'm doing nothing much but starting firefox, using selenium. Which of course means a lot of stuff is going on under the hood, but perhaps the selenium instance of firefox is not "human" enough?

So I tried a few different things to try to look more human:

  1. Maybe I just need to browse. Like a human.

There are many theories that talk about things like mouse movement, keyboard strokes, etc. So the browser starts up, I type in the URL, I click a few other links, I come back to the login page, type in username + password, then proceed to click on the captcha box...and I'm a bot.

  1. Maybe I don't have any cookies or browsing history?

Selenium by default creates a new profile, so it has no cookies or browsing history. I can specify a custom profile to use, so I simply passed in my own firefox profile stored in APPDATA/roaming/mozilla/profiles. I verified that all of the websites that I have saved my credentials were there in the selenium-launched browser, but when I confronted the reCAPTCHA, it determined I was a bot and asked for image selection

  1. Maybe I need to use caching?

By default, selenium uses a custom cache path that is cleaned up after the session is over. In firefox you can see this by going to about:cache and it will say something like anonymous6337741624277931373webdriver-profile\cache2, and there isn't much there.

So I decided to use my own profile's cache

profile.setPreference("browser.cache.disk.parent_directory", PATH_TO_MY_PROFILE_CACHE);

And verified that all of my cached resources are there. But it didn't make a difference.

  1. Maybe I just need to solve the captcha once?

Now I'm thinking, OK, so if google thinks I'm a bot, how about I solve the captcha in the selenium-launched browser once, let them know I'm good, and then it won't happen again? Maybe it identifies the browser as a new client, and just needs to know that this new client is not a bot.

So I solve the captcha and successfully log in. Then I logged out, returned to the login page, entered my credentials, pressed the reCAPTCHA box....and it asked me to solve the image selection problem again!

At this point I'm thinking, I just solved the captcha successfully half a minute ago, exhibited a bunch of manual human actions, but I'm still being identified as a bot.

Is there something specific about selenium that's making google identify me as a bot automatically?

I have used a custom profile, with custom cache path. I use cookies. I have all my regular extensions that I have installed on my profile. My user agent is unspoofed and it's no different from my normal browsing experience. There's nothing in the request headers that would suggest it is any different from a regular browser.

I would conclude that there is something on selenium's end that is causing me to be identified as a bot, when I'm using the browser as a regular user.

Perhaps there are specific JS objects that are injected into the DOM that google picks up on?

Improve this question
7
  • 3
    Found a paper that discusses external analysis of the recaptcha system: blackhat.com/docs/asia-16/materials/…
    – MxLDevs
    Commented Apr 18, 2018 at 18:58
  • 4
    If you want to do a complete integration test you must also solve the captcha to make sure its not broken.
    – JonathanReez
    Commented Apr 18, 2018 at 21:16
  • Do you have access to developers/website source to modify with changes allowing you to bypass CAPTCHA?
    – Peter M. - stands for Monica
    Commented Apr 19, 2018 at 12:09
  • 1
    “Recently the website changed their login system by adding google's reCAPTCHA” Only the login page? If yes, what prevents you from logging in manually once, then storing the auth cookies for later usage? Does the website require you to login at every browser launch?
    – Andrea Lazzarotto
    Commented Apr 19, 2018 at 15:23
  • 1
    So you are using a bot and wondering why google detects that? My guess is that google will do their best to make sure that whatever workaround you find will be fixed...
    – oerkelens
    Commented Apr 20, 2018 at 7:37

8 Answers 8

Reset to default
27

By definition, resolving a CAPTCHA cannot be automated: Otherwise it could not tell computers and humans apart and hence fails being a CAPTCHA.

How to handle a CAPTCHA in a test environment:

  • Use a service like http://www.deathbycaptcha.com which has an API to return the text of the CAPTCHA for you. Average response is 15 seconds with a result rate of 90% or so they say. Sounds like something to try.
  • Google officially prevents automated integration testing of any platform using google oauth. If you're using a gsuite domain for your test accounts, however, you can run your own identity provider to handle the auth
  • Ask your development team to remove the CAPTCHA field on the test environment.
  • Ask your development team to make a sandbox like CAPTCHA, that will accept a single input text every time
  • If your are using custom CAPTCHA module, you can ask developer to generate an API of CAPTCHA generation for testing environment.
  • You can ask dev team to add CAPTCHA code as title in markup, then you can access this title and bypass the CAPTCHA, but only in the testing environment.

Generally if they've added a CAPTCHA to their site, they might have noticed spam attempts to login and such want to mitigate those. Contact the website administrator and mention to them what you've been doing and ask if they'd provide something for you so you can continue what you're doing.

Improve this answer
4
  • 1
    Thanks for the response. The server I am working with is 3rd party. I maintain these automation tools to avoid having to manually check websites all the time (and there are several dozen). What I am interested in is whether anyone has been able to make an instance of a selenium-driven browser look like a real browser to google's captcha service. It uses a real browser, that I can perfectly control myself, after all. The only difference I can tell at this point is whether I launch it manually, or launch it via selenium. Google does have a no-captcha captcha, which does not require me to solve.
    – MxLDevs
    Commented Apr 18, 2018 at 18:44
  • 20
    @MxyL Trying to make your bot not look like a bot is fighting against Google. They have advanced algorithms to try and detect this stuff, and they aren't going to tell you how they are detecting bots. You can try, but I think it'd be a waste of time and money unless you have a lot of resources to spare.
    – Nathan Merrill
    Commented Apr 19, 2018 at 3:13
  • 4
    Worth noting that services such as DeathByCaptcha, work by outsourcing your captcha to humans - they are not doing anything smart/technical to solve them automatically. Whether that's a concern or not is a different matter, but it's worth knowing how they work.
    – Bilkokuya
    Commented Apr 19, 2018 at 9:25
  • 6
    +1 although I'd slightly challenge: "By definition, resolving a CAPTCHA cannot be automated". The design goals are that it cannot be automated; however, not being automatable(?) does not follow by definition.
    – TripeHound
    Commented Apr 19, 2018 at 13:07
16

If you are using reCAPTCHA v2, you can bypass it using test keys.

With these test keys, you will always get No CAPTCHA and all verification requests will pass.

Site key: 6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI
Secret key: 6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe

The reCAPTCHA widget will show a warning message to ensure it's not used for production traffic.

Source: Google Developer FAQ.

Of course, this isn't what you'd need on a production site... but for those struggling to bypass Google reCAPTCHA for automation testing, this is ideal.

Improve this answer
1
  • This isn't going to work for the situation described above though, is it? In the OP they describe a situation where they haven't implemented the reCAPTCHA themselves but it's on a third party website.
    – vanamerongen
    Commented Oct 16, 2018 at 15:50
9

CAPTCHA is added to a website to prevent programs like yours use the website.

It is by design that you cannot bypass it (unless website developers provide you for a way to bypass it). As you found out, the design works.

You can do one of:

  • use a service (humans) which will solve CAPTCHA for you (for a fee, and seems that some services free)
  • build such service yourself, by providing something what user want, so they will be enticed to solve those CAPTCHA for you
  • write a step in the test to solve the CAPTCHA and continue. I did it by dropping into a Python debugger, making appropriate clicks, and continuing the test.
Improve this answer
3
  • Minor typo: "be design" -> "by design"
    – Andrew T.
    Commented Apr 19, 2018 at 8:08
  • 1
    Post some highly desirable content on line, and protect it with a copy of the captcha you need solved ... and record and re-use the solution your visitors give you....
    – rackandboneman
    Commented Apr 19, 2018 at 15:05
  • 1
    @rackandboneman - IIUC, that's exactly what my second option says, do you interpret it differently?
    – Peter M. - stands for Monica
    Commented Apr 19, 2018 at 15:45
4

The Webdriver specification defines a navigator.webdriver property to indicate if UA is controlled by automation. This property is defined and returns true when running Chrome with the --headless flag.

Look at that: https://www.chromestatus.com/feature/6216034532982784

Improve this answer
4

As @John Doe mentioned, it might be due to the navigator.webdriver DOM property being true by default in Selenium-driven browsers. In Firefox, you can set the dom.webdriver.enabled config variable to false (go to about:config to change the variable), which disables this property. In my case this stopped reCAPTCHA triggering.

Improve this answer
1

You really should setup a proper test environment that has the captcha disabled. Either disable it on your current test environment, or setup a new one specifically for Selenium.

It will save you much money and pain in the future, compared to designing a solution that might work today but will be fought in the future as illegitimate services start to use it too.

Improve this answer
0

Though many have tried to give the idea about what can trigger the captcha, I would add my own experience

  1. IP address
  2. using proxy or not
  3. Length of your browsing sessions (Bots have predictable short browsing sessions)
  4. Activity in other tabs
  5. You are downloading all styles/image files or not
  6. Currently logged in google account
  7. Previous search history using google
  8. Mouse movement inside Recaptcha image box.

As suggested in other answers the best thing to do in this situation represents the captcha to the tester and solve it manually and then reproduce the same behaviour using the headless browser.

Improve this answer
0

When you open an instance of chrome or Firefox through the selenium web driver, arguments are added.

Some of these can be removed, for example, I set some experimental options and now if I manually click on the captcha check box on chrome it won’t get images even if I started the instance with selenium.

However, if I get the web driver to click on the check box I get fading images(the highest level of reCAPTCHA).

Improve this answer
1
  • 1
    Your answer would be more helpful if you were to edit your answer to explain which experimental options you used and whether those options carry over to the Selenium profile.
    – Kate Paulk
    Commented Oct 21, 2019 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.