AI + Reverse Engineering in Action: Breaking a Click CAPTCHA in 40 Minutes for $110

AI Meets Reverse Engineering: A New Way to Freelance

A new kind of freelance model is taking shape in the programming gig market — combining traditional reverse engineering with AI-assisted coding. A Bilibili content creator recently shared a real-world case: a CAPTCHA-breaking job that paid around 800 RMB, completed in just over 40 minutes with AI assistance.

The core logic isn't complicated, but it points to a clear trend: once you understand the critical techniques of reverse analysis, layering AI on top multiplies your efficiency dramatically. Work that once required grueling manual "old-school coding" can now be handed off to AI for the heavy lifting — while you focus on the key breakthroughs.

From Packet Capture to Locating the Encryption Point

The job involved a click-based CAPTCHA. The creator's first step was the most fundamental: right-click, inspect, and open the browser's developer tools to analyze network traffic.

By manually triggering the CAPTCHA (clicking a few random positions), three key requests were captured — one CAPS-related type request, one carrying a UID, and one called point.json. The point.json request was clearly encrypted, and it turned out to be the heart of the entire cracking process.

Once the encrypted request was identified, the relevant file was located and a breakpoint was set for debugging. Triggering the CAPTCHA again hit the breakpoint, exposing the encryption logic.

The Encryption Method and the Key to Coordinate Recognition

Breakpoint analysis revealed that the CAPTCHA uses AES encryption (Encrypt), built on the CryptoJS library. Unlike CAPTCHAs that verify mouse movement trajectories, this one only submits coordinates — no sliding path required. That makes it significantly easier to crack, since you only need accurate coordinate recognition.

This is exactly where AI shines. Coordinate recognition can be handled by OCR tools — the creator mentioned solutions like Suite OCR and IPID OCR as viable options. In the demo, the correct result was returned on the second attempt, almost instantaneously.

AES (Advanced Encryption Standard) is the most widely used symmetric encryption algorithm today — the same key is used for both encryption and decryption. CryptoJS is a pure JavaScript cryptography library heavily used in front-end pages to encrypt data in the browser before sending it to the server. The key challenge in reverse engineering is finding the key and IV (initialization vector) inside obfuscated JS code — they're often hardcoded in scripts or delivered dynamically via API. Once you have those two parameters, you can replicate the encryption logic locally and construct request bodies the server will accept. Compared to slide-based CAPTCHAs that require simulating mouse trajectories with precise timing and acceleration data, pure coordinate submission only requires passing correctly encrypted (x, y) values — dramatically reducing overall complexity.

Automated Execution with AI Assistance

With accurate recognition in place, the next step was wiring everything together. The creator demonstrated calling the process via AR in a CMD environment — conceptually straightforward: pass the target URL and recognition result to the corresponding interface, and the whole flow runs. Once it worked the first time, batch automation was trivial.

This is the real value of the "technical skill + AI" combination. Using AI alone without understanding reverse engineering won't get you past encryption and validation layers. But pure manual coding without AI keeps your throughput low. Together, they let you break through barriers while compressing delivery time to the minimum.

How to Get Started in This Kind of Freelancing

For those looking to get into this type of work, the creator's advice is to start by mapping out the knowledge framework — ideally with a mind map — and thoroughly mastering the core reverse engineering skills: packet capture and analysis, breakpoint debugging, identifying encryption algorithms (like AES), and OCR-based coordinate recognition. Then layer AI-assisted coding on top to boost output efficiency.

A word of caution: CAPTCHA breaking and similar reverse engineering work touches on the security mechanisms of target websites. In real-world applications, it's essential to stay within legal and ethical boundaries — unauthorized data scraping and cracking can cross serious legal lines. The technology itself is neutral; how you use it determines its value and its risks.

This 800 RMB, 40-minute case makes one thing clear: AI hasn't replaced reverse engineering skills — it's amplified their earning potential. Mastering the underlying principles and making smart use of AI tools may well be the dominant path for freelance programmers going forward.

Getting started in reverse engineering typically requires building skills across several layers. First, network-layer analysis: capturing HTTP/HTTPS requests using Chrome DevTools or tools like Fiddler/Charles, and understanding the relationships between request headers, cookies, and encrypted parameters. Second, JavaScript debugging: setting XHR breakpoints or function breakpoints in the browser to trace the call stack of encryption functions. Third, algorithm recognition: quickly identifying whether you're dealing with AES, RSA, MD5, etc., and locating the key source. AI coding tools (like ChatGPT or Claude) primarily help with code generation and translation — describe the JS encryption logic you extracted from a breakpoint, and the AI can quickly produce a Python implementation, saving you the manual translation effort. The learning path is clear: reverse analysis skills are the prerequisite, AI tools are the efficiency multiplier, and you genuinely need both.