Miscellaneous Hacks - Enhanced Captcha Image Verification - stop bots from signing up!!

Title : Enhanced Captcha Image Verification

Version : 1.1

Coder : Andy Calderbank & Jason Williams

Purpose : Add extra Image Verification to the registration process, using an alternative system to the Captcha system.

Why : It would appear that spammers can now "read" the Captcha codes and overcome the verification process.

How : This extra feature uses images which are harder for a spam program/bot to interpret than text characters. The user has a choice of 4 randomly displayed images, and the answer is given below. The user must click on that image to proceed, if the incorrect image is selected an error message is shown. The images are randomly shown (from however many are in the directory - you can have as many as you want, just has to be more that 4!) and are automatically created from the images/verification/ directory - all on the fly. Sample images are included with this release, but you can use your own - I recommend using 100 x 100 pixels, in .jpg format and naming the image with a meaningful title (ie A House.jpg) - the extension is stripped so only the filename itself is shown.

To further enhance security, the images are passed through a script which means that none of the images on the screen have file names - and cannot be associated to the question by title alone.

I have been testing this on my forum and have found it to be effective - I cannot guarantee that this will stop all spamming, but this relies more on human input than a computer "reading" the image.

Important : This has been tested on 3.6.2 - I cannot guarantee it will work on anything above, please test with caution - and as always BACKUP FIRST! This will not work on anything below 3.6.0.

Demo : http://www.steadiforum.com/register.php

I hope this is help to the VBulletin community as I know this is a growing problem. I don't fancy the thought of trawling through hundreds of new members deleting stupid usernames and spam posts.

Installation :

1. Upload the verification/ directory to your images/ folder - make sure .htaccess and show.php are present - otherwise it won't work.
2. Import Product - product-image_verification.xml

Upgrading :

1. Upload show.php to the images/verification/ directory.
2. Import Product - product-image_verification.xml - select Allow Overwrite to enable upgrade.

Requirements : GD Libraries installed

File uploads : 39 (including images)
Files to Import : 1
New Templates : 1
New Phrases : 5
Uses Hooks : 1
New Queries : 0

History :
v1.0 - Original release
v1.01 - Slight code change for forums in sub-directories (thanks go to Barakat for solving this one)
v1.1 - Issue resolved with Windows servers also template clean up for xhtml compliance
v1.11 - Added version check function, minor upgrade.

Done - if you like please click install! (and I won't ask for any donations as long as you click Nominate for MOTM!)

Don't forget you don't have to use the provided images - you can customise these to any you wish - I've used ones that are hopefully universal and everyone will recognise.

[radarhunter]

excellent thingie man

[nervous]

Great hack but not work on vBulletib 3.6.7 PL1

[radarhunter]

Originally Posted by nervous

Great hack but not work on vBulletib 3.6.7 PL1

i dun`t know about u buddy but it works on my forum (version 3.6.7 PL1)


http://www.stepheniansonline.com/forum/register.php?

pic attached for proof

[J.R. Rogers]

This worked once and then never worked again. No errors in apache log or anything... it just doesn't show up anymore. Clicking registration takes you right to the date of birth question. I'm running vB 3.6.7 PL1.

edit: When I tried it from another computer, I got the images on the first registration attempt. I continued to see the images until I chose the correct image. Then, I couldn't get them to come back. When I tried to register again, it dropped me to the date of birth question bypassing the image verification.

Is this mod setting a cookie or something so you only see it once per computer until you get the answer right? If so, ummmm...

JR

[radarhunter]

it is because when u click on the right option it kindda creates a cookie in ur explorer and it doesn`t show again.. Kindly access ur site from some other browser and u`ll see it is there..

plus if spammers are still hacking ur forum you can turn on the default vb image verification .......

that will take care of things.........

[karlm]

Dang, I was looking for this exact project not too long back..couldn't find it though. It does sexy though!

Is it purely for registrations only - or can it be used where-ever captcha is used, e.g. guest posts or searches, etc?

[karlm]

for this to work, i had to hash out the .htaccess file... I'm assuming my host doesn't like having index redirection.

[KPalicz]

I love this, it has stopped spam dead on our forum. Excellent hack.

[steadicamop]

Hey guys ... some encouraging posts there - sorry for my lack of presence, had some personal issues - but am still working on the Flash version of this .... which I'm hoping will take this to the next level.

Jason

[steadicamop]

Just a note about the .htaccess file : it isn't totally required, a blank index.html file will do - it's just something to stop the contents of the directory being trawled - and in all honest not that it would make any difference anyway as they would just have a list of images - which wouldn't really do any good for figuring out which pictures matches the text.

It's just there as some extra security - if you can't get the .htaccess file working - don't worry.

Cheers

Jason