Skip to content

Name the captcha this site actually uses, and pin its key as a marker - #3

Merged
jehrr merged 1 commit into
mainfrom
captcha-vendor
Sep 14, 2026
Merged

jehrr merged 1 commit into
mainfrom
captcha-vendor

Conversation

@jehrr

@jehrr jehrr commented Sep 14, 2026

Copy link
Copy Markdown
Collaborator

The README said the site ships an empty <captcha-widgets> mount point and left it there. Reading the site's own JavaScript says which captcha it is.

Finding

Google reCAPTCHA, site key 6LeubLYqAAAAAK7-X6nc1fW2ggot_vTvQAv0RxdU, in dubizzle's own bundles twice:

  • RECAPTCHA_KEY in the argument object handed to showAuthPopup(...), beside GOOGLE_APP_ID and FACEBOOK_APP_ID;
  • recaptchaSiteKey in the app config.

showAuthPopup is called with intent: "login" or "phoneverify". So the captcha guards signing in and verifying a phone number — not reading listings, which is why 17 captures and 5 live runs met none.

Why the version is not claimed

None of the site's 104 listing chunks contains the recaptcha/api.js loader or a single grecaptcha.* call — the widget is rendered by a separate auth application the listing pages never load. The render= parameter that settles v2 against v3 is therefore not observable from anything this scraper fetches, so it is left unanswered rather than guessed, and a check asserts that neither the README nor the parser writes "reCAPTCHA v2" or "v3".

Why the key is safe as a marker

It appears in 0 of 17 captures. Checked before adding it — the rule that keeps a marker from matching every good page, which this repo already applies to _Incapsula_Resource and to the bare <captcha-widgets> tag. Its presence in a page now means the site has rendered its own challenge into what we were given, rather than that we recognised some vendor's script.

525 offline checks, pytest green, ci_checks --all and --history-check clean.

@jehrr
jehrr merged commit 76bb7a5 into main Sep 14, 2026
7 checks passed
@jehrr
jehrr deleted the captcha-vendor branch September 14, 2026 15:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant