PolyCaptcha

KO | EN

gitlite — search

#javascript #react #ai #typescript #android #machine-learning #docker #nodejs #java #windows #awesome #cli #vue #ios

(★ 11)

PolyCaptcha is a Flask‑based web application that mimics Google’s image‑based reCAPTCHA flow to demonstrate how attackers can use visual deception, clipboard poisoning, and file‑format spoofing to trick users into downloading and executing malicious code.

PolyCaptcha Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# **PolyCaptcha: reCAPTCHA Awareness Malware Demo**

**PolyCaptcha** is a Flask‑based web application that mimics Google’s image‑based reCAPTCHA flow to demonstrate how attackers can use visual deception, clipboard poisoning, and file‑format spoofing (via **[I‑Espresso](https://github.com/AnonKryptiQuz/I-Espresso)**) to trick users into downloading and executing malicious code. This PoC is strictly for educational, research, and security‑testing purposes.

## **Features**

* **Blurred‑Image Challenge**: Prompts the user to “Identify the object” using a blurred picture.
* **Forced Download**: Requires downloading `reCAPTCHA.png` (a dual‑format EXE/PNG) to continue.
* **Clipboard Poisoning**: Automatically copies the full malicious Win+R command to the clipboard.
* **Dual‑Format Payload**: Uses **[I‑Espresso](https://github.com/AnonKryptiQuz/I-Espresso)** to wrap a Windows PE inside a `.png`.
* **AV Evasion Demo**: Shows how extension spoofing and user‑driven execution bypass antivirus.

## **Prerequisites**

* **Python 3.7+**
* **Flask**
* **I‑Espresso** – PE File Generator with Extension Spoofing by AnonKryptiQuz (Polyglot Generator)

* Repository: [https://github.com/AnonKryptiQuz/I-Espresso](https://github.com/AnonKryptiQuz/I-Espresso)

## **Installation**

1. **Clone the repository:**

```bash
   git clone https://github.com/AnonKryptiQuz/PolyCaptcha.git
   cd PolyCaptcha
   ```

2. **Install required Python packages:**

```bash
   pip install -r requirements.txt
   ```

Ensure that `requirements.txt` contains the following:

```
   flask
   ```

## **Usage**

1. **Start the Flask server:**

```bash
   python app.py
   ```

2. **Open your browser** and navigate to:

```
   http://localhost:5000/
   ```

3. **Follow the on‑screen prompts:**

1. You’ll see a blurred image and the text:

> “Identify the object in the image to continue. This helps prevent bots from solving the challenge.”
   2. Click **Download** to save `reCAPTCHA.png` (actually a PE wrapped as PNG via [I‑Espresso](https://github.com/AnonKryptiQuz/I-Espresso)).
   3. The tool automatically copies this command into your clipboard:

```
      cmd /c start "" "%USERPROFILE%\Downloads\reCAPTCHA.png" & echo # ✅ 'I am not a robot - reCAPTCHA Verification ID: 83472'
      ```
   4. Press **Win + R**, **paste** (Ctrl+V), and **Enter**.

* Only the “I am not a robot…” text is visible at a glance, hiding the `cmd /c start…` launch.
      * The embedded payload (e.g. Calculator in PoC) executes while the image displays.

## **Disclaimer**

* **Educational Purposes Only**
  PolyCaptcha is intended solely for awareness, research, and security testing.
* **Legal Notice**
  Unauthorized use against real users or live environments is unethical and may violate laws.

## **Author**

**Created by:** [AnonKryptiQuz](https://AnonKryptiQuz.github.io/)

PolyCaptcha

PolyCaptcha Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

PolyCaptcha

PolyCaptcha Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README