Re: Captcha testing

Dave Ferguson <[email protected]>
Newsgroups gmane.comp.security.websecurity,gmane.comp.security.web-applications
Message-ID <[email protected]> 
Take a look at
http://www.owasp.org/index.php/Testing_for_Captcha_%28OWASP-AT-008%29

I have seen several "home grown" Captcha implementations that were flawed.
One thing you should definitely test is whether there are "clues" on the
client side that allow users to determine the correct characters.  For
example, each time you generate a Captcha image, view the HTML source of the
page, JavaScript, etc., and look for anything that changes. If something
changes, compare it to the image.  Try to determine a correlation.

Dave


On Fri, Oct 1, 2010 at 11:25 AM, Kiran Kumar <[email protected]> wrote:

> Hi all,
>
> I required to test captcha feature. Is there any standards to test this
> feature? please suggest me any materials & tools.
>
> Thanks in advance
> Kiran Kumar
>
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.