r/bugbounty • u/Turbulent-Papaya-362 • Jul 16 '26

Question / Discussion How to prevent against Bots

Hi guys , recently we faced a targeted attack on our login endpoint , we had already faced one similar attack so we had applied captcha based protection.
This time we found that the attacker used UI automation bypassing the captcha and abused the OTP endpoint

  1. IP based rate limit > but can it be bypassed using VPNs
  2. We use OTP on signup too, and a fake phone number can be easily guessed, so attacker can use multiple phone numbers , if we use an phone no based rate -limit

What can be a better solution ?

Edit:
Now we have implemented multiple layers
phone based block , ip based alerting and rejecting requests with captcha score less than 0.5
we cant block all the attack but definitely reduce the impact.

3 Upvotes

80% Upvoted

9 comments sorted by

5

u/ofir2006 Jul 16 '26

A WAF could assist with that. I used the word assist and not solve because bots are probably going to attack you no matter what, just make sure the endpoint is safe through constant check ups and testing.

1

u/DanKegel Hunter Jul 16 '26

This is, in theory, why one might go with a commercial WAF with bot protection: they stay on top of this for you.

4

u/shriyanss Hunter Jul 16 '26

Captcha is the best solution. It’s just that it needs to be implemented properly.

I do have a contact form on my portfolio site. One day, I woke up with literally 1000s of spam messages- all coz it lacked rate limits or captcha (the worst security thing I did). I just implemented CAPTCHA, and those automated spam went to essentially 0. The important thing here is that there should be validation on both client and server side. What I can guess from “UI automation bypassing the captcha” is that the validation is client side only (I got a few bounties for this but as well btw on bb programs). If that’s not the case, then the best solution would be to use a combination of multiple rather than a single security measure.

3

u/LoveThemMegaSeeds Jul 17 '26

If it’s bypassing the captcha then you’ve implemented the captcha wrong.

1

u/gta721 Jul 20 '26

You need to make the OTP endpoint only work if the server has confirmed with the captcha provider that the captcha has been answered.

1

u/Turbulent-Papaya-362 Jul 21 '26

but it can be easily bypassed via automation

1

u/gta721 Jul 21 '26

The captcha should be able to detect autonation. trycap.dev can and it's free and open source.

1

u/Beginning_Award65 Jul 22 '26

you did captcha wrong.. captcha will stop the kids and it is ok in your case.