Secured Access Portal

Authenticate to access privileged security auditing instruments.

Host Check: Current host is localhost. Key is bound to security.wiperspace.com.

•

Security Identity / Email *

Passphrase * Test phrase allowed

Bot Mitigation Check

Pending Verification

Retain session context Level: High Assurance

Quick Attack Simulation Scenarios

LIVE MONITOR

Client Token Telemetry

Expiry: --:--

Key: g-recaptcha-response Length: 0 chars Awaiting input

Simulates the mandatory server-side verification with Google's endpoint: https://www.google.com/recaptcha/api/siteverify

siteverify request & response inspector STANDBY

{
  "audit_status": "ready",
  "instructions": "Solve the reCAPTCHA on the left or click 'Trigger Verification Query' to inspect the payload."
}

Implementation Guide:

server.js - Secure reCAPTCHA Verification

// 1. Never trust the frontend: Always verify g-recaptcha-response on the backend!
const express = require('express');
const app = express();
app.use(express.json());

const RECAPTCHA_SECRET = '6LdFkP4tAAAAAPxS7_NM-CS-DomhIIiIKQPJQbT1';
const ALLOWED_HOSTNAME = 'security.wiperspace.com';

app.post('/api/login', async (req, res) => {
  const { username, password, recaptchaToken } = req.body;

  if (!recaptchaToken) {
    return res.status(400).json({ success: false, error: 'reCAPTCHA token missing.' });
  }

  // 2. Query Google's verification endpoint
  const verifyParams = new URLSearchParams({
    secret: RECAPTCHA_SECRET,
    response: recaptchaToken,
    remoteip: req.socket.remoteAddress // optional client IP
  });

  try {
    const googleRes = await fetch('https://www.google.com/recaptcha/api/siteverify', {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: verifyParams.toString()
    });

    const data = await googleRes.json();

    // 3. CRITICAL AUDIT: Check data.success AND data.hostname to stop bypasses!
    if (!data.success) {
      return res.status(403).json({ success: false, error: 'reCAPTCHA validation failed', codes: data['error-codes'] });
    }

    if (data.hostname !== ALLOWED_HOSTNAME && process.env.NODE_ENV === 'production') {
      return res.status(403).json({ success: false, error: 'Hostname mismatch exploit detected!' });
    }

    // 4. Proceed to verify user password safely
    return res.json({ success: true, message: 'Authenticated successfully!' });
  } catch (err) {
    return res.status(500).json({ success: false, error: 'CAPTCHA service unavailable' });
  }
});

app.py - Secure reCAPTCHA Verification in Flask

import requests
from flask import Flask, request, jsonify

app = Flask(__name__)
RECAPTCHA_SECRET = "6LdFkP4tAAAAAPxS7_NM-CS-DomhIIiIKQPJQbT1"
ALLOWED_HOSTNAME = "security.wiperspace.com"

@app.route("/api/login", methods=["POST"])
def login():
    data = request.get_json() or {}
    token = data.get("recaptchaToken")
    
    if not token:
        return jsonify({"success": False, "error": "reCAPTCHA token missing"}), 400

    # Query Google SiteVerify API
    verify_url = "https://www.google.com/recaptcha/api/siteverify"
    payload = {
        "secret": RECAPTCHA_SECRET,
        "response": token,
        "remoteip": request.remote_addr
    }
    
    resp = requests.post(verify_url, data=payload, timeout=5)
    result = resp.json()

    # Verify both success and hostname match
    if not result.get("success"):
        return jsonify({"success": False, "error": "Invalid CAPTCHA token"}), 403

    if result.get("hostname") != ALLOWED_HOSTNAME:
        return jsonify({"success": False, "error": "Invalid origin hostname"}), 403

    # Authenticate credentials
    return jsonify({"success": True, "message": "Access granted"})

<?php
$secret = '6LdFkP4tAAAAAPxS7_NM-CS-DomhIIiIKQPJQbT1';
$token = $_POST['g-recaptcha-response'] ?? '';

if (empty($token)) {
    http_response_code(400);
    echo json_encode(['success' => false, 'error' => 'Token required']);
    exit;
}

$verifyResponse = file_get_contents('https://www.google.com/recaptcha/api/siteverify?secret=' . $secret . '&response=' . urlencode($token));
$responseData = json_decode($verifyResponse, true);

if (!$responseData || !$responseData['success']) {
    http_response_code(403);
    echo json_encode(['success' => false, 'error' => 'CAPTCHA failed']);
    exit;
}

// Proceed with authentication
echo json_encode(['success' => true, 'message' => 'Logged in']);
?>

CRITICAL

Client-Side Only Validation Vulnerability

Checking grecaptcha.getResponse().length > 0 in frontend JS without validating on the backend is trivial to bypass. Attackers can strip the JS check or curl the endpoint directly.

Fix: The backend must call api/siteverify and abort if success !== true.

HIGH

Missing Hostname Verification

An attacker can create their own reCAPTCHA key for their own malicious domain, solve it legitimately, and forward the token to your server.

Fix: Check that data.hostname === 'security.wiperspace.com' in the JSON verification response.

HIGH

Token Replay Attack Window

Google automatically invalidates a token once verified with siteverify. If backend code caches tokens or fails to verify immediately, replay attacks become possible.

Fix: Verify token once immediately upon form receipt; never cache valid tokens across requests.

BEST PRACTICE

Fail-Closed Architecture

If Google's API experiences a network timeout, deciding whether to allow the request (fail-open) or block it (fail-closed) determines resilience against DDoS.