Cracking CAPTCHA with Padding Oracle attack

This video shows how to crack all CAPTCHA in a target website using only JavaScript hosted on a different machine. We do that by exploiting Padding Oracle and web browsers cross-domain information leakage vulnerabilities. One can easily turns this exploit into a distributed attack. Please see our paper at http://www.netifera.com/research for more technical details. Thank you and happy hacking! --Juliano Rizzo and Thai Duong