Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


Forums › IT Pro and developers › PHP Capcha has been hacked/abused by spammers
mattwnz

20515 posts

Uber Geek
+1 received by user: 4795


#94952 22-Dec-2011 23:09
Send private message

I am using the following capcha script attach to a contact form on a few websites, but noticed that one of them has been having spam injected into it, even though it has a capcha on it. It's getting spammed about 20 times a day. http://www.thewebhelp.com/php/scripts/php-contact-form-with-image-validation/

Now there is either a hole in the script, such as sessions not being wiped after the form is submitted, or the spammer is using OCR software to overcome the capcha, or possibily something else. Anyone know if there is anything that can be added to make this more secure?


Create new topic
Oblivian
7345 posts

Uber Geek
+1 received by user: 2117

ID Verified

  #560851 23-Dec-2011 00:05
Send private message

This is the reason PHPBB and vBulletin are abused so much. Captchas just don't cut the mustard anymore.

Re-code it for human interaction (please type 'x' in the box provided for verification) along with it. Seems to work for forums :)

http://en.wikipedia.org/wiki/CAPTCHA shows a few methods they are using to circumvent them, and recommends a PHP adjustment to kill session IDs.



mattwnz

20515 posts

Uber Geek
+1 received by user: 4795


  #560852 23-Dec-2011 00:22
Send private message

Oblivian: This is the reason PHPBB and vBulletin are abused so much. Captchas just don't cut the mustard anymore.

Re-code it for human interaction (please type 'x' in the box provided for verification) along with it. Seems to work for forums :)

http://en.wikipedia.org/wiki/CAPTCHA shows a few methods they are using to circumvent them, and recommends a PHP adjustment to kill session IDs.


Thanks, I had been using it for about 5 years, and it has only just now begun to happen. I was looking at a script which asks the user to enter the sum of two numbers, as a replacement, at http://www.codegravity.com/projects/mathguard which looks quite good.

I did read that bit on wikipedia about killing session IDs, but have no idea where to add the code into it. The code does delete the cookies, but I suspect that it doesn't kill the sessions.


02.// -----------------------------------------
03.// The Web Help .com
04.// -----------------------------------------
05.// remember to replace you@email.com with your own email address lower in this code.
06.
07.// load the variables form address bar
08.$subject = $_POST["subject"];
09.$message = $_POST["message"];
10.$from = $_POST["from"];
11.$verif_box = $_POST["verif_box"];
12.
13.// remove the backslashes that normally appears when entering " or '
14.$message = stripslashes($message);
15.$subject = stripslashes($subject);
16.$from = stripslashes($from);
17.
18.// check to see if verificaton code was correct
19.if(md5($verif_box).'a4xn' == $_COOKIE['tntcon']){
20.// if verification code was correct send the message and show this page
21.mail("you@email.com", 'TheWebHelp.com Form: '.$subject, $_SERVER['REMOTE_ADDR']."\n\n".$message, "From: $from");
22.// delete the cookie so it cannot sent again by refreshing this page
23.setcookie('tntcon','');
24.} else if(isset($message) and $message!=""){
25.// if verification code was incorrect then return to contact page and show error
26.header("Location:".$_SERVER['HTTP_REFERER']."?subject=$subject&from=$from&message=$message&wrong_code=true");
27.exit;
28.} else {
29.echo "no variables received, this page cannot be accessed directly";
30.exit;
31.}

Create new topic








Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Updates »

Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.








RSS feeds
Main feed
Forums feed
Copyright
©2002-2026 Geekzone®
Site features
Geekzone BI dashboard
Geekzone Badges
Geekzone Status Page

 

Site Information
Subscribe to Geekzone
Privacy Statement
Forum Usage Guidelines (FUG)
Advertising
Trademark and copyright