Find the callback function of reCaptcha

How to find the callback function of each version of reCaptcha

recaptcha callback function

After obtaining the successfully recognized gRecaptchaResponse value through the API, if you are using simulation software, such as selenium, you need to execute a callback function to tell the webpage that we have successfully recognized, so let's learn how to find this function:

Note: In some cases, there is indeed no callback function. In this case, you can directly assign values to the g-recaptcha-response container and submit the form.

Search by automatic search function

Press F12 to enter the Console, and enter the following auto-defined function findRecaptchaClients()

function findRecaptchaClients() {
// eslint-disable-next-line camelcase
  if (typeof (___grecaptcha_cfg) !== 'undefined') {
// eslint-disable-next-line camelcase, no-undef
    return Object.entries(___grecaptcha_cfg.clients).map(([cid, client]) => {
      const data = { id: cid, version: cid >= 10000 ? 'V3' : 'V2' }
      const objects = Object.entries(client).filter(([_, value]) => value && typeof value === 'object')

      objects.forEach(([toplevelKey, toplevel]) => {
        const found = Object.entries(toplevel).find(([_, value]) => (
          value && typeof value === 'object' && 'sitekey' in value && 'size' in value
        ))

        if (typeof toplevel === 'object' && toplevel instanceof HTMLElement && toplevel['tagName'] === 'DIV') {
          data.pageurl = toplevel.baseURI
        }

        if (found) {
          const [sublevelKey, sublevel] = found

          data.sitekey = sublevel.sitekey
          const callbackKey = data.version === 'V2' ? 'callback' : 'promise-callback'
          const callback = sublevel[callbackKey]
          if (!callback) {
            data.callback = null
            data.function = null
          } else {
            data.function = callback
            const keys = [cid, toplevelKey, sublevelKey, callbackKey].map((key) => `['${key}']`).join('')
            data.callback = `___grecaptcha_cfg.clients${keys}`
          }
        }
      })
      return data
    })

  }
  return []
}

findRecaptchaClients && findRecaptchaClients()

Then execute this function findRecaptchaClients() in console to find the corresponding function

Case 1: If the value of the function returns a string value

funtion is "verifyDemoRecaptcha"

As you can see, our callback function here is verifyDemoRecaptcha, and then we only need to execute this function in selenium.

driver.execute_script(f'verifyDemoRecaptcha("{gRecaptchaResponse}")')

We can test this case on the website: https://2captcha.com/vi/demo/recaptcha-v2-callback

Case 2: If the value of the function returns a function

function is funtion

For this kind of anonymous function, we only need to execute it according to the complete path we just found, and the effect is the same, for example:

___grecaptcha_cfg.clients['0']['M']['M'].callback('{gRecaptchaResponse}')

We can test this case on the website: https://accounts.google.com/v3/signin/