CAPTCHA authentication

CAPTCHA-based logins add an extra layer of security to prevent automated bot access, but they also add complexity for DAST tools that must authenticate before scanning. When a login flow includes an image- or text-based CAPTCHA, or a reCAPTCHA challenge, AppScan provides mechanisms to reliably record and replay these flows during scanning.

Note:
CAPTCHA challenges are used for login purposes only.

Refer to this page if your application's login form requires solving a CAPTCHA before submission. It explains the supported CAPTCHA types, configuration requirements, limitations, and troubleshooting steps needed to help your scan proceed without interruption. While some CAPTCHA challenges, such as text or simple image puzzles, can be handled by automated or AI-assisted techniques, infrastructure-level CAPTCHAs (such as reCAPTCHA v2/v3 or behavior-based challenges) often require specific configuration to maintain scan continuity. Understanding how these mechanisms work is essential for successful authentication and complete coverage during your DAST scan.

Note:
AppScan Standard templates that use CAPTCHA-enabled login are not supported in AppScan Enterprise.

Supported CAPTCHA types

AppScan supports the following CAPTCHA implementations:

  • CAPTCHA v1 (AI-based image recognition)

  • reCAPTCHA v2 (challenge-based: interactive checkbox)

  • reCAPTCHA v3 (behavior-based: invisible scoring)

CAPTCHA v1 (AI-based)

  • Overview: CAPTCHA v1 is solved by using AppScan's AI-based recognition engine.
  • Configuration:
    • Ensure that an AI provider is configured. Otherwise, CAPTCHA solving fails during login recording.
    • Enable CAPTCHA on the MFA configuration page.

  • When manual configuration is needed: If automatic detection fails:

    • Manually specify the image element ID and input field ID, and then record the login.

    • Optionally switch to a larger or more advanced AI model to improve accuracy.

reCAPTCHA v2 and v3 (infrastructure-based)

  • Overview: Automating login for an application that uses reCAPTCHA v2/v3 requires bypassing the challenge. This is done by configuring IP allowlisting in Google Cloud so that Google treats AppScan traffic as trusted.

  • Configuration requirements:

    • Confirm with the site owner that the reCAPTCHA keys are valid and active for the correct domains.

    • Identify the public IP addresses AppScan will use.

    • When IP checks are enabled by the site owner, challenge tokens are bound to the originating IP address. If the scanner's IP changes during the process (for example, because of load balancing or multi-node scanning), validation fails. To resolve this issue, manually allowlist the scanner's public IP address or subnet in the provider's console (for example, Google Cloud console) to ensure that the originating IP is trusted.

      • Local or private IP addresses cannot be used.
    • For reCAPTCHA v2, start login recording by using only the AppScan browser with manual recording.

  • Limitations:

    • reCAPTCHA v2

      • Automatic login is not supported.

      • It does not work with the external browser.

Troubleshooting

Note:
To check whether AppScan detected the CAPTCHA or filled it in correctly, set SessionManagement:ShowActionBasedPlayerWindow (from Tools> Options> Advanced) to “True” to view the replay of the recorded actions and identify the issue.
Table 1. CAPTCHA troubleshooting
Issue Possible cause Recommended action
CAPTCHA v1 fails during login AppScan does not recognize the image or input text as CAPTCHA elements. Identify the HTTP parameter ID for the CAPTCHA image and text, and add it manually. For more information, see How to identify the CAPTCHA HTTP parameter.

AI model unable to solve complex images

Switch to a larger or more advanced AI model. (e.g., GPT-4 vs. mini models). The default model may fail on difficult images.
reCAPTCHA v2/v3 fails during login recording or playback

reCAPTCHA is not fully initialized or verified.

 Record the login again. Initialization delays are common.
reCAPTCHA authentication fails because of allowlisting issues

  1. Wait for the allowlisting to take effect, and then try again.

  2. Verify that the machine's public IP matches the allowlisted IP in the Google Cloud console.
Session context not captured Record the login again and select a different page after login (for example, the home page).
Timing delays in the login flow Increase action-based delays (Advanced Configuration).

Timing delays during playback

 Insert a manual wait action before the CAPTCHA step.
Page loads too slowly for CAPTCHA to initialize Add a longer crawler delay or an explicit wait (for example, 10 seconds) before CAPTCHA interaction.

How to identify the CAPTCHA HTTP parameter

AppScan needs to know the name of the parameter that contains the CAPTCHA so it can log in to the application. It usually identifies this parameter when validating the recorded login procedure. If it does not, or if you use Automatic Login, you must add the parameter yourself.

  1. Open a browser and go to your application's login page.
  2. Click F12 to open the browser's developer tools pane (usually on the right side of, or below, the main browser pane).
  3. Click the Elements tab to view the HTML code. When you select part of the code, the corresponding element is highlighted in the main browser pane.
  4. Locate the CAPTCHA element and identify the id.

    Example:

    <img id="captchaImage" src="./captcha?ts=1782734992413" alt="Captcha" width="180" height="56">
  5. The value of the id parameter, without the quotation marks, is the CAPTCHA HTTP parameter that you need.

    Example:

    captchaImage