nelsonblaha/neocaptcha-motion-attack

This project is a research demonstration that shows how a certain kind of CAPTCHA, the puzzle websites use to check you are a human, can be solved with old fashioned statistics rather than any AI or machine learning. The CAPTCHA in question, called a NeoCaptcha style challenge, hides letters inside a box of moving random pixel noise. A single still frame looks like pure static, and the letters only become visible because they move differently from the background noise around them. The people behind this style of CAPTCHA claim it is proof against AI, arguing that a model would have to redo significant deciphering work for every single new challenge. The author wrote a short, fixed Python script, about 150 lines long, that reads the answer directly out of a video recording of the challenge, with no training data and no per challenge reasoning involved. It works by noticing that the letters move quickly and consistently from frame to frame, while the background noise changes in a way that has no consistent direction. The script detects the moving region, filters out slow moving background noise, measures how fast each small area of the image moves, and turns that motion pattern into a clean, readable image of the letters. It then uses an OCR text reading tool to read the letters and figure out exactly where to click, in the order the challenge asks for. The README credits two other independent projects that had already shown similar CAPTCHA styles could be broken using comparable motion based tricks, and explains how this script's approach differs and where it borrows ideas. It also includes a faster live mode that reads the answer from only a fraction of a video clip, well within the CAPTCHA's normal time limit, showing the attack works fast enough to be practical rather than just theoretical. The project explicitly describes itself as a defensive and educational demonstration meant to prove that this specific AI proof claim does not hold up, rather than a tool meant to attack real websites at scale. It is written entirely in Python and only needs a video file of the challenge to run against, plus standard tools like ffmpeg and tesseract OCR. The full README is longer than what was shown.