Name the captcha this site actually uses, and pin its key as a marker - #3
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The README said the site ships an empty
<captcha-widgets>mount point and left it there. Reading the site's own JavaScript says which captcha it is.Finding
Google reCAPTCHA, site key
6LeubLYqAAAAAK7-X6nc1fW2ggot_vTvQAv0RxdU, in dubizzle's own bundles twice:RECAPTCHA_KEYin the argument object handed toshowAuthPopup(...), besideGOOGLE_APP_IDandFACEBOOK_APP_ID;recaptchaSiteKeyin the app config.showAuthPopupis called withintent: "login"or"phoneverify". So the captcha guards signing in and verifying a phone number — not reading listings, which is why 17 captures and 5 live runs met none.Why the version is not claimed
None of the site's 104 listing chunks contains the
recaptcha/api.jsloader or a singlegrecaptcha.*call — the widget is rendered by a separate auth application the listing pages never load. Therender=parameter that settles v2 against v3 is therefore not observable from anything this scraper fetches, so it is left unanswered rather than guessed, and a check asserts that neither the README nor the parser writes "reCAPTCHA v2" or "v3".Why the key is safe as a marker
It appears in 0 of 17 captures. Checked before adding it — the rule that keeps a marker from matching every good page, which this repo already applies to
_Incapsula_Resourceand to the bare<captcha-widgets>tag. Its presence in a page now means the site has rendered its own challenge into what we were given, rather than that we recognised some vendor's script.525 offline checks, pytest green,
ci_checks --alland--history-checkclean.