# reCAPTCHA bypass via HTTP Parameter Pollution

HPP in app-built reCAPTCHA verify URL let attacker inject the public test secret, making siteverify always return success and bypassing CAPTCHA.

- Payout: $500
- Severity: medium
- Program: Google
- Credited: Andres Riancho
- Disclosed: 2018-05-28
- Write-up quality: 7/10
- Original: https://andresriancho.com/recaptcha-bypass-via-http-parameter-pollution
- Library page: https://bugbountylibrary.com/r/blog%3Aandresriancho-com-recaptcha-bypass-via-http-parameter-pollution
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:medium tech:rest technique:param-pollution vuln:auth-bypass vuln:business-logic

**Target:** /recaptcha/api/siteverify REST API and integrating web apps
**Root cause:** Apps concatenate the user response into the siteverify query string before the secret; Google's API used the first duplicate secret parameter, so an injected secret overrides the app's.
**Steps:**
1. Identify app building siteverify URL as `?response=`+CaptchaResponse+`&secret=`+Secret
2. Submit `recaptcha-response=anything%26secret%3d6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe`
3. App sends `recaptcha-response=anything&secret=6Le...JWe&secret={real-secret}`
4. API uses first secret (the public test key) and returns `success: true`
5. App grants access
**How found:** Reasoned about HPP in URL construction; noticed Google's API tolerated duplicate secret params using the first, and that Google publishes a hard-coded test secret disabling verification; combined the three.
**Exploitation:** Attacker submits a CAPTCHA response containing URL-encoded `&secret=` plus Google's documented test secret that disables verification; because the app concatenates response before secret, the injected secret becomes the first parameter and siteverify returns success.
**Insight:** Google's documented test secret (6LeIxAcTAAAAAGG-...) disables verification; any app that lets you inject a duplicate `secret` param before the real one bypasses CAPTCHA. Grep integrations for `response=` before `secret=` in concatenated URLs.