// challenge
what is aws waf captcha?
a waf-challenge challenge; used by amazon; mints the aws-waf-token token; escalation: 200: silent challenge token (JS pow) on the challenge action → 405 / interstitial: a visible captcha on the captcha action → 403: block on a deny rule. managed-pow; a WAF rule issues a silent JS pow or a visible puzzle depending on the configured rule action (allow/count/challenge/captcha).
source capture undated
in the benchmark
aws waf captcha is tracked as part of the challenge taxonomy. see how tracked tools score against it on the capability matrix.