kindly need response on what to proxy to bypass that im willing to pay lil coin for this
find request with /recaptcha/enterprise/anchor
and modify parameter co= with orignal domain on fly .
that should work .
Please go more In depth I’m having same issue send I used year previously haven’t been able to figure this out
You say the param co= in url for sub_filters or just pish sub please id app any help
there is one request getting send to backend with /recaptcha/enterprise/anchor
and it has a get parameter co=xxxxxxx so you have to modify this value to orignal domain before it gets to backend so for this you have 1 option .
modify evilginx code to intercept GET requests and add ability to modify parameter value .
that will solve your issue .
please how can modify evilginx code to intercept GET requests and add ability to modify parameter value .
that will solve your issue
i am having the same problem with my yahoo phishlets which i think the configuration to get the recaptcha fixed might be like this, i haven’t try it tho.
{triggers_on: ‘login.yahoo.com’, orig_sub: ‘login’, domain: ‘google.com’, search: ‘co=aHR0cHM6Ly9sb2dpbi55YWhvby5uZXQ6NDQz’, replace: ‘co={hostname}’, mimes: [‘text/html’, ‘text/javascript’, ‘application/javascript’, ‘application/json’]}
i’m open to correction tho
1 Like
Modified code with force get support avilable in study material . 
Good morning Master Fluxxset, i will be paying for your course possibly today.
@mdexecutives did your configurations worked properly?
Hi bro i think i had same issue with my yahoo phishlet . whenever i enter my username i get this error.
Have I captured request in burp ?
How dose it looks ?
Is it sending to the proxied host or any other ?
@fluxxset You’re wrong! yahoo does not make any request with /recaptcha/enterprise/anchor, after the username is submitted they make a request to /account/challenge/recaptcha which is related to the iframe. Just checked with burp 2mins ago.
@fluxxset oh and btw if setup locally with self signed certs the phishlet works perfectly fine, which is probably the reason people think its still works in 2025 but once you move to a real domain and server recaptcha breaks the flow
okay , do you have solution for that ?
Can someone please explain for me i have same issue with yahoo, how can i bypass the capture or make it work properly
exactly bro. this issue only happens with real domains and server set up. If proxy with good proxy provider. it reduces the chance of getting the error. But some sturbborn username still does it. Please do you have fix for this.
Thanks
Hi Future Users,
@fluxxset was correct in his quick reply managing the /recaptcha/ enpoint. Altough I am not familiar with replacing the captcha parameters. I think it would be smartest to just complete the captcha presented. As this is also what the server expects.
Get siteKey
You can intercept the webpage req’s and will see enpoint /recaptcha/api2/anchor this will contain the siteKey a value set for domain’s corresponding to captcha service presented by google. Just like most other google key’s present accross webpage’s it’s static.
It will start with &k= , example url for random webpage; GET /recaptcha/api2/anchor?ar=1&k=6LdktRgnAAAAAFQ6icovYI2-masYLFjEFyzQzpix&co=aHR0cHM6Ly93d3cuZmJzYnguY29tOjQ0Mw..&hl=enGB&v=rW64dpMGAGrjU7JJQr9xxPl8&theme=dark&size=normal&cb=rtzxdhi47to3
Get Captcha Page URL
You will be able to find the captcha from the loaded url within webpage, once again use a network intercept tool. Most of the time the captcha will be loaded within a iframe .
Search for this iframe request, and it will once more contain /captcha/recaptcha/ within url enpoint.
Once you have found the request for loading captcha, you can confirm the captcha url by visiting the host + url, e.g;
www.fbsbx.com/captcha/recaptcha/iframe/?__cci=ig_captcha_iframe&compact=false&locale=en_GB&referer=https%253A%252F%252Fwww.instagram.com&dark_mode=true
( clicking above link will navigate to the active captcha site )
Find where captcha token is sent to server post req
Most of the time the solved captcha token will be sent a few requests further, this time the url will not indicate the token being used. Instead think logically where the token could be sent.
For instance the variable captcha_token= will most likely be used, and it ALWAYS is a POST req.
Because of the logic of how captcha’s are solved, anyone can do it and then return the captcha to you. Solved captcha tokens are valid for a entire domain, the only identifier is the domain.
So this allows service’s like anticaptcha to offer for very cheap to solve and return solved captcha’s tokens to you.
Send solved captcha token within req js_inject
Now I am quite sure you could just force the phishing page to send the solved captcha token with you’re request when phishing users. Completely bypassing the captcha needed, or even errors with captcha loading.
| @fluxxset please kindly verify this approach 
.