> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/how-to-trigger-an-external-scan/handling-captcha-email-mobile-otps.md). # Handling Captcha/Email/Mobile OTPs Pentest Copilot handles verification codes and captchas automatically while you record a login. Record once, the platform re-authenticates on every later test run. ### What the platform handles | Challenge | What you do | | ------------------------ | ----------------------------------------------------------------- | | Email OTP | Click **Auth Actions** > **Email OTP** in the VNC browser toolbar | | Magic link | Click **Auth Actions** > **Email Magic Link** | | SMS OTP | Click **Auth Actions** > **Phone OTP** | | TOTP (authenticator app) | Paste the Base32 secret into the TOTP helper | | OCR image captcha | Click **Auth Actions** > **OCR Captcha** | | reCAPTCHA/hCaptcha/etc. | Nothing | ### Where to find assigned identities Open **Browser Session Manager**, choose **Create New Session**, and select one of the email identities assigned to your workspace before clicking **Start Recording**. Later scans poll only the selected identity's inbox for email OTPs and magic links. Use only identities shown in the product. Do not create your own variants or append suffixes to an address unless that exact identity has been assigned to your workspace. ### Email OTP and magic links | Scenario | Action | | ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | Standard login | Use the assigned email identity selected for the session. When the target asks for a code, click **Auth Actions** > **Email OTP**. | | Magic-link login | Use the assigned email identity selected for the session. Then click **Auth Actions** > **Email Magic Link**. | | Unique-per-account signup | Select an available assigned identity from the identities area. Random plus-address suffixes are not monitored unless explicitly listed. | | Target blocks the address | Use another approved assigned identity or ask Bugbase to provision a compatible address for the engagement. | The platform reads the incoming mail, extracts the code or opens the magic link, and continues. ### SMS OTP Use the phone number shown in the recording flow only when the target requires a phone number. When the target sends a text code, click **Auth Actions** > **Phone OTP** in the VNC browser toolbar. SMS is handled through the product flow, not by directly monitoring or forwarding text messages to you. ### TOTP (authenticator apps) When the target shows a QR code or Base32 secret during authenticator setup: | Step | Action | | ---- | -------------------------------------------------------------------------------------------------- | | 1 | Click the **TOTP** button in the recording toolbar | | 2 | Paste the Base32 secret, e.g. `JBSWY3DPEHPK3PXP` | | 3 | When the target asks for a code, click the OTP field. The platform types the current 6-digit code. | The secret saves with the session. On every future run, the platform regenerates the current code and types it. ### OCR image captcha Use **Auth Actions** > **OCR Captcha** when the target shows a text captcha as an image and asks you to type the letters or numbers into a nearby input field.
| Step | Action | | ---- | ---------------------------------------------------------------------------------------------------------------------------------------------- | | 1 | Click **Auth Actions** > **OCR Captcha** in the VNC browser toolbar. | | 2 | When the status bar says to click the captcha image, click the image that contains the letters or numbers. | | 3 | When the status bar says to click the captcha input, click the textbox where the solution should be entered. | | 4 | Wait while the status bar shows that the captcha is being solved. The platform fills the solved text into the selected input when it is ready. | | 5 | Continue the login or signup flow normally. | The captcha image can be loaded from a normal image URL or embedded directly as base64; Pentest Copilot normalizes either form before solving it. The recorded browser action includes both the captcha image and the input field, so later session replay can solve a fresh image and type the answer into the same field. Do not manually click and fill the captcha input after using **OCR Captcha**. The OCR Captcha auth action records and performs the fill itself. ### Other captchas Nothing to do. The platform detects and solves: * reCAPTCHA v2 and v3 * hCaptcha * Cloudflare Turnstile * Non-OCR image, text, and audio puzzles If the captcha solver cannot complete a challenge during recording, solve it manually and note the case for follow-up. ### Recording checklist | Step | Action | | ---- | -------------------------------------------------------------------------------------------------------------- | | 1 | Open Browser Session Manager, choose Create New Session, and click Start Recording | | 2 | Select the assigned identity to use for this session | | 3 | During login, use **Auth Actions** for Email OTP, Email Magic Link, Phone OTP, TOTP, or OCR captcha challenges | | 4 | For TOTP, use the helper button when the target shows a Base32 secret | | 5 | For OCR image captchas, click the captcha image first, then the captcha input when the status bar asks | | 6 | Let reCAPTCHA, hCaptcha, Turnstile, and other supported captchas resolve on their own | | 7 | Finish the login, stop recording, save | ### FAQ | Question | Answer | | -------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | Are the assigned inboxes real? | Yes. Each assigned identity is monitored for the workspace and can be selected when recording a browser session. | | Can I append my own suffix to an assigned email address? | No. Later scans poll only the exact identity selected for the session. | | Can I monitor SMS messages directly? | No. Use the **Phone OTP** Auth Action in the VNC browser flow when the target sends a text code. | | What if a code expires before it's used? | Polling runs every few seconds, so timeouts are rare. Failed runs are flagged for re-recording. | | Is my TOTP secret secure? | It's stored inside the session record in your workspace, not shared across tenants. | | What if the OCR captcha answer is wrong? | Reload the captcha and run **OCR Captcha** again. If it repeatedly fails, solve it manually and note the case for follow-up. | | Do I need my own Capsolver or 2Captcha account? | No. Captcha solving is included. | ### On-premise or custom tenant? If you're running Pentest Copilot on your own infrastructure or need dedicated identities (e.g. because the target allow-lists specific domains), we can provision approved email or phone values for the engagement. Captcha auto-solve can also be disabled per deployment when manual solving is required.