hCaptcha supported
Send a sitekey and a page URL. Capybara solves the captcha in a real browser and returns the vendor’s token.
Three steps from a sitekey to a captcha response.
One POST with the sitekey, the page URL and, if you want your own exit, a proxy. You get a task id back straight away.
It loads the widget on your target’s own origin, moves the pointer the way a person does and clicks the checkbox. Some sitekeys pass right there.
When a challenge opens, Capybara reads it off the live page: the instruction, how many tiles, and when a new screen has replaced the last one.
A vision model looks at the picture and answers with coordinates on it: which tiles to pick, where to click, what to drag. Capybara performs them and submits. Up to eight screens.
Poll the task and take the token once status is solved. Hand it to the site as the captcha response, the same way the widget would have.
Every token is minted in an actual Chrome, with the widget loaded on your target’s own origin. Nothing is replayed and nothing is forged, which is why the token behaves like one the page minted itself.
The checkbox gets clicked, the challenge gets read off the live page and answered, and the token comes out of the widget callback the way it would for a person. One task covers the whole sequence, however many rounds it runs.
The pointer follows a curved path with human timing and a small overshoot, not a teleport to the centre of a tile.
Pass a proxy on the task and the whole solve runs through it, so the token is minted from the IP you care about.
Capybara is a research project and a tool for testing the sites and flows you own or are authorised to test. Solving captchas on third-party sites without permission may breach their terms of service or the law where you are. You are responsible for how you use it.
One POST with the vendor, the sitekey and the page URL the widget sits on. You get a task id back. Poll the task, and when the status is solved the token is on it, ready to submit to the site as the captcha response.
Three things. The token is minted in a real Chrome with the widget loaded on your target’s own origin, so it is a genuine token rather than a replay. The pointer moves along a curved, human-timed path instead of jumping to a tile centre. And the solve runs through the proxy you pass, so the IP that mints the token is the one you chose.
Yes, per task. HTTP, HTTPS or SOCKS5, with credentials in the URL. The whole solve runs through it, so the token is minted from that IP.
hCaptcha, including passive passes, tile grids, point selection, drag, multi-screen challenges and animated canvas screens. FunCaptcha is coming soon.
The vendor decides that, and the task carries the expiry it was given. Treat a token as something to submit promptly rather than to store.
Capybara is in early access. Leave an email and you will hear when there is a key with your name on it.
