nelsonblaha/neocaptcha-motion-attack — explained in plain English
Analysis updated 2026-05-18
Study how a motion-noise CAPTCHA can be defeated using frame-to-frame motion analysis instead of machine learning.
Learn a reproducible method for separating fast-moving foreground text from noisy background frames.
Evaluate whether a specific captcha's AI-proof security claim actually holds up.
Use the live mode as a reference for reading a stable answer from only part of a video stream.
| nelsonblaha/neocaptcha-motion-attack | 95ge/cfquant | aevella/sky-pc-mcp-companion | |
|---|---|---|---|
| Stars | 26 | 26 | 26 |
| Language | Python | Python | Python |
| Setup difficulty | moderate | moderate | moderate |
| Complexity | 3/5 | 3/5 | 3/5 |
| Audience | researcher | developer | vibe coder |
Figures from each repo's GitHub metadata at analysis time.
Requires ffmpeg and tesseract OCR installed alongside Python and NumPy.
This project is a research demonstration that shows how a certain kind of CAPTCHA, the puzzle websites use to check you are a human, can be solved with old fashioned statistics rather than any AI or machine learning. The CAPTCHA in question, called a NeoCaptcha style challenge, hides letters inside a box of moving random pixel noise. A single still frame looks like pure static, and the letters only become visible because they move differently from the background noise around them. The people behind this style of CAPTCHA claim it is proof against AI, arguing that a model would have to redo significant deciphering work for every single new challenge. The author wrote a short, fixed Python script, about 150 lines long, that reads the answer directly out of a video recording of the challenge, with no training data and no per challenge reasoning involved. It works by noticing that the letters move quickly and consistently from frame to frame, while the background noise changes in a way that has no consistent direction. The script detects the moving region, filters out slow moving background noise, measures how fast each small area of the image moves, and turns that motion pattern into a clean, readable image of the letters. It then uses an OCR text reading tool to read the letters and figure out exactly where to click, in the order the challenge asks for. The README credits two other independent projects that had already shown similar CAPTCHA styles could be broken using comparable motion based tricks, and explains how this script's approach differs and where it borrows ideas. It also includes a faster live mode that reads the answer from only a fraction of a video clip, well within the CAPTCHA's normal time limit, showing the attack works fast enough to be practical rather than just theoretical. The project explicitly describes itself as a defensive and educational demonstration meant to prove that this specific AI proof claim does not hold up, rather than a tool meant to attack real websites at scale. It is written entirely in Python and only needs a video file of the challenge to run against, plus standard tools like ffmpeg and tesseract OCR. The full README is longer than what was shown.
This project is a small Python script that solves a motion-hidden CAPTCHA using plain statistics, showing the puzzle's AI-proof claim does not hold up.
Mainly Python. The stack also includes Python, NumPy, ffmpeg.
The explanation does not state a license, so terms of use are unclear.
Setup difficulty is rated moderate, with roughly 30min to a first successful run.
Mainly researcher.
This repo across BitVibe Labs
Verify against the repo before relying on details.