Analyzing and Decoding CAPTCHA Images Using PHP

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a public program that distinguishes humans from computers by presenting challenges that only humans can solve.

The tutorial first introduces the basic concept and common types of image‑based CAPTCHAs, then demonstrates how to retrieve the RGB values of every pixel in a GIF image using PHP's imagecolorsforindex function.

Sample code used to load the image and collect RGB data:

$url = 'http://210.32.33.91:8080/reader/captcha.php';
$im = imagecreatefromgif($url);
imagegif($im, '1.gif');
$rgbArray = array();
$size = getimagesize($url);
$wid = $size['0'];
$hid = $size['1'];
for ($i = 0; $i < $hid; ++$i) {
    for ($j = 0; $j < $wid; ++$j) {
        $rgb = imagecolorat($im, $j, $i);
        $rgbArray[$i][$j] = imagecolorsforindex($im, $rgb);
    }
}

After obtaining the RGB matrix, the script visualizes the image by printing a square (□) for background pixels with a red component of 212 and a filled square (■) for foreground pixels, making the pattern clearer.

Next, the binary representation (0 for background, 1 for foreground) of each digit is extracted by removing spacing and segmenting the image into 8×10 blocks. These binary strings are stored in a dictionary that maps each pattern to its corresponding digit:

$dic = array(
    '00011000001111000110011011000011110000111100001111000011011001100011110000011000' => 0,
    '00011000001110000111100000011000000110000001100000011000000110000001100001111110' => 1,
    // ... patterns for 2‑9 omitted for brevity ...
    '00111100011001101100001111000011011001110011101100000011010000110110011000111100' => 9
);

By converting each captured CAPTCHA image to its binary pattern and looking it up in the dictionary, the script can decode the numeric code. A test loop over 100 random CAPTCHAs showed a 100% success rate.

The article concludes with a reminder that this technique is intended for legitimate web developers to understand CAPTCHA security and should not be used for illegal purposes.