Mini Mods - Harmor's Bot Protection

Here is a demo

Let me explain how this works.

On the registration page a potiental user has to enter a random character of a word.
I have done something different though. It randomly selects a username from the database to be used as the word.

Some of you may be asking "Can you explain how it does the checking"?
On the registration page I have a hidden form that contains a hashed version of the correct character. After the form is submitted it checks if the the hashed version of the character you typed against the correct hash.

If you installed this hack you can enable it by going to
vBulletin Options --> User Registration Options
The option to enable/disable the feature and to add your own hash are at the bottom.


If you are upgrading this hack you'll need to edit the "register" template.

Go to your ACP >> Styles & Templates >> Style Manager
Expand the template you want to edit.
Expand the Registration Templates category

Open: register
Find:

What is the first character of <b>$ahbot[username]</b>?

Replace with:

What is the $char_loc character of the word <b>$ahbot[username]</b>?

[Pyrix]

Just thinking, you may be able to secure it a little more by appending the vbulletin license number (or a random string stored in vb options) to the character before you hash it (both times). This is known as 'salting', and would make the 'MD5 hash table' bypass much, much harder. You might want to Google that and read up on it

Don't know what you can do about the other thing though - you could turn it into an image but then what advantage does it give over vb's default captcha?

[harmor19]

Can bots read the source code?

[DiSpy]

Pyrix is right, salting the hash would work wonders... may I suggest letting the admins choose their own salt in the admin CP. That way each board has it's own salt.

The second issue about the bot automatically "looking at the webpage" for a value, can also be solved using the admin CP. Just let users customize the question in thier own words, and customize the title (where it says "Harmor's Bot Protection" and "What is the first character of" in the screen shot).

Also, I was thinking... how hard would it be to allow the admin to choose EITHER the 1st, 2nd, 3rd character the users should enter (set via admin cp). This would make is at least not exactly the same on all boards, and since vB has min usernames set at more than 3, it should always work.

Just my $0.02 cents.

[harmor19]

Hopefully I increased the security of this hack. It now selects a random character instead of asking the user to enter the first character.

Here is a snippet of code I added.

PHP Code:

if(empty($vbulletin->options['harmor_bot_protection_hash']))
{
  $vbulletin->options['harmor_bot_protection_hash'] = "gwetg7gaswegty7sawfrtq2w6t";
}

$word = $ahbot['username']{$ah_rand - 1};
$hash = md5(md5($word).$vbulletin->options['harmor_bot_protection_hash']); 


The screenshot has been updated as well. Attachment 63065

[Mr Chad]

Originally Posted by harmor19

Can bots read the source code?

of course they can...

they filter through the source to find hash's so they can do things (and the hashs were made to stop them).

[harmor19]

Originally Posted by Mr Chad

of course they can...

they filter through the source to find hash's so they can do things (and the hashs were made to stop them).

Thanks for answering my question.

[smess]

what happens for example if people have a space in their name so the user name is "no gas" and you ask for the third letter? is it g or space, etc??

[harmor19]

Originally Posted by smess

what happens for example if people have a space in their name so the user name is "no gas" and you ask for the third letter? is it g or space, etc??

I didn't take that into account. I'll update the hack soon. Thank you for pointing that out.

[harmor19]

Originally Posted by smess

what happens for example if people have a space in their name so the user name is "no gas" and you ask for the third letter? is it g or space, etc??

I have updated the hack to remove spaces in usernames. "no gas" becomes "nogas".

[TeamDevotion]

Isn't this the point of image verification?