Mitigate submission flooding with ALTCHA proof-of-work

[victormeloasm]

Summary

This PR introduces ALTCHA, an open-source Proof-of-Work (PoW)
CAPTCHA system, to mitigate automated submission flooding on
Crackmes.one.

The implementation replaces Google reCAPTCHA with a self-hosted
verification mechanism that does not require external CAPTCHA
API keys or third-party verification services.

The primary goal is to protect crackme and writeup submissions
against automated abuse while preserving the existing user
experience and application functionality.

Key Features

Security

• HMAC-signed Proof-of-Work challenges.
• Server-side cryptographic verification.
• MongoDB-backed replay protection using atomic operations.
• Single-use challenges to prevent token reuse.
• Challenge expiration and tamper detection.
• Protection against cross-form token reuse.
• Fail-closed behavior on invalid configuration or database errors.
• Rate limiting for challenge generation.

Integration

• CAPTCHA protection for crackme uploads.
• CAPTCHA protection for writeup submissions.
• Optional protection for registration and comments.
• Independent configuration for each protected feature.
• Integration with the existing Flask architecture.
• Compatibility with CSRF protection and AJAX submissions.
• Automatic challenge renewal after failed submissions.
• No external CAPTCHA API credentials required.

Infrastructure

• Shared replay protection across multiple Gunicorn workers.
• MongoDB TTL index initialization.
• Configurable HMAC secrets and challenge difficulty.
• Documentation for deployment and rollback.
• Optional local hosting of the ALTCHA JavaScript widget.

Testing

The implementation has undergone automated and integration testing.

Automated Tests

• 346 tests passed.
• 25 ALTCHA-specific tests passed.
• Overall code coverage: 81.74%.
• ALTCHA service coverage: 93%.
• Required minimum coverage: 75%.
• No failing tests.

Browser Integration

Successfully tested using Chromium and Playwright:

• Real ALTCHA challenge generation and resolution.
• Crackme submissions with valid CAPTCHA proofs.
• Writeup submissions with valid CAPTCHA proofs.
• Rejection of submissions without CAPTCHA.
• No uncaught JavaScript exceptions.

Concurrency and Replay Protection

Tested against a real MongoDB instance with Gunicorn
configured for five workers.

20 concurrent HTTP requests attempted to reuse the
same valid ALTCHA proof.

Results:

• 1 request accepted (HTTP 200).
• 19 requests rejected (HTTP 400).
• Exactly one consumed proof recorded in MongoDB.
• Multiple Gunicorn workers participated in the test.
• No successful replay observed.

Deployment Notes

Production deployment requires:

1. Generating and configuring secure HMAC secrets.
2. Enabling ALTCHA for the desired submission endpoints.
3. Configuring shared rate-limiting storage.
4. Ensuring MongoDB connectivity and TTL index initialization.
5. Optionally hosting the ALTCHA widget locally instead of
   loading it from the pinned CDN version.

No external CAPTCHA verification service is required.

Motivation

Crackmes.one has experienced automated submission flooding,
which increases moderation workload and negatively affects
the quality of submissions.

This implementation introduces a lightweight cryptographic
barrier against automated submissions without requiring
users to solve traditional image-based CAPTCHA challenges.

Proof-of-Work alone cannot eliminate all automated abuse.
It is intended to complement existing authentication,
rate limiting, and submission validation mechanisms.

Conclusion

This PR provides an independently verifiable,
open-source CAPTCHA solution designed to reduce
automated submission flooding while preserving the
existing Crackmes.one submission workflow.

[xusheng6]

Thanks for the PR! Unfortunately, I do not think this is doing things in the right way. Right now, we already have rate limits, e.g., https://github.com/crackmesone/crackmesone_python/blob/main/app/services/limiter.py#L9-L19. Which is enforced at https://github.com/crackmesone/crackmesone_python/blob/main/app/controllers/solution.py#L157. I think the correct way to deal with the load is to just set a lower limit, e.g., 5 per day for crackme and submission upload