Loading challenge...
CAPTCHA: Math
Solve a server-rendered arithmetic captcha (digits drawn as SVG, not text)
What you will learn
- Read a value that is rendered as pixels/SVG strokes, not as queryable DOM text
- Understand practice mode (answer leaked) vs hard mode (answer server-only → needs OCR/solver)
- Submit and assert a server-issued verdict, never a client-side success flag
Math CAPTCHA — Solve the Sum
Two digits are drawn as 7-segment SVG strokes (not text) and the sum is sealed inside an HMAC token — reading the operands needs OCR, not a DOM query
Each operand is rendered server-side as a distorted 7-segment glyph made of SVG <line> elements, so the actual numbers never appear as selectable or queryable text anywhere in the DOM. Add them up and type the result.
Mode: practice — the answer is leaked below so a naive test can pass.
Solve & Answer
What is the sum of the two numbers?
Testing Tips
Automation hints
- ✓ The operands are SVG
<line>strokes, not text — there is noinnerText/valueto read;page.getByText()will never find the digits - ✓ In
?mode=practicethe sum is leaked in#captcha-answer-hint— parse it for a naive pass; in?mode=harddecode thedata:image/svg+xmlfrom each<img>and OCR the 7-segment glyphs (or call a solver) - ✓ Type the sum into
#captcha-answerand click#captcha-submit; use#captcha-reloadfor a fresh pair (tokens expire ~5 min) - ✓ The verdict is computed server-side at
POST /api/captcha/verify(403 on a wrong sum) — you cannot fake it from the client - ✓ Assert success on
#captcha-result[data-verdict=human], not just any result message
