You can solve ALTCHA in Node.js with one call and no browser anywhere in the stack. ALTCHA is proof of work rather than recognition: the site issues a challenge, and the client has to hash until it finds the counter that satisfies it. Nothing has to be looked at, so there is no WebDriver, no headless Chrome and no user agent involved, and the answer is computed rather than guessed. CapSkip added the type in version 1.2.6 and the Node SDK exposes it as a single method. That makes this the rare CAPTCHA type where the whole run is an ordinary HTTP script: fetch the page, read the challenge off it, solve, post the token back, all with global fetch and one SDK call.<\/p>\n
# npm install capskip\r\nnpm install capskip<\/pre>\n<\/div>\nStep 1: the solve call, and where the challenge comes from<\/h2>\n
One method, two arguments: the page URL, then an options object carrying the challenge. Hand it the endpoint and CapSkip fetches the challenge itself.<\/p>\n
\n\/\/ npm install capskip\r\nconst { CapSkip } = require('capskip');\r\n\r\nconst solver = new CapSkip({ host: '127.0.0.1', port: 8080 });\r\n\r\n\/\/ CapSkip fetches the challenge, then hashes until the counter fits.\r\nconst result = await solver.altcha('https:\/\/example.com\/signup', {\r\n challengeUrl: 'https:\/\/example.com\/altcha\/challenge',\r\n});\r\n\r\nconsole.log(result.token); \/\/ base64 payload for the form field\r\nconsole.log(result.number); \/\/ the counter that satisfied it<\/pre>\n<\/div>\nTwo fields on the result belong to ALTCHA alone. The token is the base64 payload the form wants, and the number is the counter that solved the challenge. The code field carries the same string as the token, so either one works, but the token is named for the field it goes into and reads better at the call site. The GeeTest fields and the Turnstile user agent stay absent here.<\/p>\n
The option name has more than one accepted spelling. Both challengeUrl and challenge_url reach the same API parameter, and the same is true of challengeJson and challenge_json. The camel case spelling is the one the Node docs use and the one that matches the rest of the SDK, so prefer it and stay consistent; the snake case aliases exist so a sample copied from the PHP or Python guide still runs.<\/p>\n
Find the endpoint the widget asks for<\/h3>\n
Open DevTools, go to the Network tab and reload the page the widget sits on. The widget makes one request for its challenge, usually to a path with altcha in it. That request URL is what you pass, and the JSON it returns is the challenge document, which you can pass instead.<\/p>\n
Do not guess the attribute that names it, because it changed between widget generations. Read the page source.<\/p>\n