smxiazi/NEW_xp_CAPTCHA

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1050 stars · 138 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

xp_CAPTCHA is a Burp Suite extension (Java plugin) that automatically recognizes CAPTCHAs during brute-force attacks, using a companion Python server powered by the ddddocr OCR library. It supports JSON response bodies, response-header tokens like UUIDs or cookies, and multiple CAPTCHAs in advanced mode.

Use cases

• brute-force login forms protected by a captcha
• automatically solve captchas in burp intruder attacks
• recognize captcha images during penetration testing
• handle captchas with uuid tokens in responses
• extract captcha session ids from set-cookie headers
• run captcha recognition locally without paid api

When to choose

• you need a free, self-hosted captcha recognition solution for burp suite
• your target uses simple captchas and you want to automate brute-force testing
• you need to handle captcha tokens embedded in bodies or response headers

When to avoid

• you need high accuracy on complex captchas, where the paid commercial version is better
• you cannot run a separate python server alongside burp
• your environment uses a newer JDK that breaks the plugin and you cannot recompile

Facets

plugin · maturity active

ocr penetration-testing security machine-learning security penetration-testing developer-tools jvm python cross-platform burp-suite captcha-recognition captcha-bypass brute-force ddddocr burp-extension

Member repositories

For agents

markdown · JSON · MCP: product_card(name="smxiazi/NEW_xp_CAPTCHA")