Version: 1.00, by Mystis
Developer Last Online: Nov 2023
Version: 2.2.x
Rating:
Released: 02-01-2003
Last Update: Never
Installs: 32
No support by the author.
Smallish hack here, basically it emulates Yahoo's, among other's, system of generating an image with a random series of characters that a user must enter correctly into a text box to register. The screenshots will illustrate this well:
Installation Instructions
----------------
See install.txt in the attachment
Minimods
---------------- Text-only version for people without access to the GD library
The font may be customized by taking a font desired, in TrueType format, and uploading it in place of the font.ttf included. the gd image library IS required to use this hack.
Awesome hack Mystis, I had wondered when something like this for vBulletin might come along.
The only question I have is what kind of service would somebody be using that is processing an automated registration for one's forum? This is just a generic question, as I've wondered the same for those Lycos/Yahoo sites. I'm guessing some kind of bot, although the chances of one doing so on a vBulletin seems less likely.
You're looking for the absolute server path to your forums' root directory. So in your example, if you're running on a linux server then a possiblity could be '/home/xxx/public_html/xxx/forum/font.ttf'. On Windows, it might be something like: "c://htdocs//users//xxx//xxx//forum//font.ttf'. I can't tell you for sure though, your best bet would be inquiring your host.
Quote:
Originally posted by Velocd Awesome hack Mystis, I had wondered when something like this for vBulletin might come along.
The only question I have is what kind of service would somebody be using that is processing an automated registration for one's forum? This is just a generic question, as I've wondered the same for those Lycos/Yahoo sites. I'm guessing some kind of bot, although the chances of one doing so on a vBulletin seems less likely.
I'ts very easy to set up a bot that can process a form repeatedly and automatically. I obviously won't give out details as to how, but it is very possible and potentially damaging to the server if it does that frequently enough. The person that I wrote the hack for actually got 10,000+ fake registrations in under a day.
Quote:
Originally posted by Boofo I ran the phpinfo and say nothing about the gd library. Chances are (knowing my host) it is not installed. Thanks, anyway.
If it isn't in phpinfo, then it likely isn't installed. I aplogize. I'll work on a text only version workaround, although it isn't nearly as secure.
Quote:
Originally posted by Davey WOW this is a good hack dude.
Thanks for releasing!
I'll definately install this if possible hehehe.
Mind you I dunno if (and doubt) lycos runs the requirements for this.
Still worth a try though.
Dave.
Sorry, but I'm pretty sure that Lycos won't run the gd. Again, keep an eye out for the text version workaround, which I'll figure out and include in my next post
<tr>
<td bgcolor="{firstaltcolor}"><normalfont><b>Automatic Registration Prevention</b></normalfont><br>
<smallfont>Please enter the text in the box below to the text box to the right. This is to prevent automatic registrations.<br><br><img src="reg_image.php?text=$image_var&colorbg={firstaltcolor}&colortext={pagetextcolor}" /><br></smallfont></td>
<td bgcolor="{firstaltcolor}"><normalfont>
<input type="text" class="bginput" name="autoveri" size="25" maxlength="15">
<input type="hidden" name="autovero" value ="$image_var">
</normalfont></td>
</tr>
and replace it with
PHP Code:
<tr>
<td bgcolor="{firstaltcolor}"><normalfont><b>Automatic Registration Prevention</b></normalfont><br>
<smallfont>Please enter the registration key below to the text box to the right. This is to prevent automatic registrations.<normalfont><br><br><smallfont><b>Registration key: $image_var<smallfont>
</td><td><input type="text" class="bginput" name="autoveri" size="25" maxlength="15">
<input type="hidden" name="autovero" value ="$image_var">
</normalfont></td>
</tr>
This wont prevent auto verification at all, all some one has to do is use fopen on the page and look for
<input type="hidden" name="autovero" value ="$image_var">
and get the value real esily, this will stop auto registration as much as not having it, also using gd every time the page is loaded will have a high load to the server, thats why im adding a cahceing option and the other options to my hack so prevent the gd causing high loads. Also there are some ways to extract this text from the image as well, you dont distort the image in any way so a bot could look through the image and compare it to others and get the text from it, the non gd support for my hack uses hash images so not even a bot can get the value from them and also alow cacheing and session limits, so if the user idles for to long it creates a new session verification value automaticly.
Also I'm not trying to put down this hack, It was a great idea, Im just stating there are some major flaws in the script.
Some of the more "smarter" auto register bot thingys can "read" images to see the registration code if it's in the normal Arial/Times New Roman type font, so you really should use some weird font if you really want to protect yourself.
Originally posted by DWZ Just a small note/warning.
Some of the more "smarter" auto register bot thingys can "read" images to see the registration code if it's in the normal Arial/Times New Roman type font, so you really should use some weird font if you really want to protect yourself.
You dont need to worry about that with this hack..it already has the verification number publicly displayed in the html...
Is there a way to use something other than the gd library to display the images (since alot of hosts don't have it installed)? If the text only version can be got around that easy, there must be another way.
Prevent Automated Registrations Details »»
About Developer
Visit Web Site
No support by the author.
02-02-2003, 11:37 PM
[/high]
