I have a contact form. On this form there is a randomly generated
string of characters that must be copied. If it is not typed
properly, the form is not processed. If filled out correctly, an
email is sent to the sender and a copy to the owner. All of the
sending is done in php and no email addresses appear on the form (nor
in the view source). Everything is done in php.
What is happening is that junk filled forms are being sent and they
are bypassing the security code requirement. To see what was
happening, I included both the generated and typed codes in the email
that is sent. When I fill it out, the email contains matching codes.
The spam email has empty fields.
Finally, I changed the form yesterday to include those security code
echos. Today's spam has the changed form.
Questions:
1 - How are they accessing the the code to generate these emails?
2 - How are they bypassing the check of the security code?
3 - Most importantly, what can I do to stop them?
Shelly
Re: Contact Form Spam
am 24.01.2008 02:47:22 von Manuel Lemos
Hello,
on 01/23/2008 11:31 PM Shelly said the following:
> I have a contact form. On this form there is a randomly generated
> string of characters that must be copied. If it is not typed
> properly, the form is not processed. If filled out correctly, an
> email is sent to the sender and a copy to the owner. All of the
> sending is done in php and no email addresses appear on the form (nor
> in the view source). Everything is done in php.
>
> What is happening is that junk filled forms are being sent and they
> are bypassing the security code requirement. To see what was
> happening, I included both the generated and typed codes in the email
> that is sent. When I fill it out, the email contains matching codes.
> The spam email has empty fields.
>
> Finally, I changed the form yesterday to include those security code
> echos. Today's spam has the changed form.
>
> Questions:
> 1 - How are they accessing the the code to generate these emails?
They may not necessarily be accessing your code. You just assumed that.
> 2 - How are they bypassing the check of the security code?
If you are using a image based CAPTCHA, there is code to brute force
guess the text in the CAPTCHA images using OCR (Optical Character
Recognition) solutions. Here is a simple OCR written in pure PHP.
http://www.phpclasses.org/phpocr
> 3 - Most importantly, what can I do to stop them?
Use a better CAPTCHA. Here are several CAPTCHA solutions that use more
advanced techniques. Some use more ofuscated images, others ask
subjective questions to the user, others use animated images, etc..
PHP professionals looking for PHP jobs
http://www.phpclasses.org/professionals/
PHP Classes - Free ready to use OOP components written in PHP
http://www.phpclasses.org/
Re: Contact Form Spam
am 24.01.2008 03:07:22 von Shelly
On Jan 23, 8:47 pm, Manuel Lemos wrote:
The email is only sent to the site owner, so the spammer has no way of
knowing what the email should look like. That tells me that they have
to be going through the form. Yet the proper email has an echo of
generated security code. The spam email has that field empty. So,
that says he can't be going through the form.
It seems to me that they must:
1 - Somehow diverting a legitimate email so that copy is sent to
them.
2 - Using that email copy to create a template and modify the output
so that junk is sent.
I really don't know how they are doing it.
Re: Contact Form Spam
am 24.01.2008 05:07:05 von Jerry Stuckle
Shelly wrote:
> On Jan 23, 8:47 pm, Manuel Lemos wrote:
>
> The email is only sent to the site owner, so the spammer has no way of
> knowing what the email should look like. That tells me that they have
> to be going through the form. Yet the proper email has an echo of
> generated security code. The spam email has that field empty. So,
> that says he can't be going through the form.
>
> It seems to me that they must:
> 1 - Somehow diverting a legitimate email so that copy is sent to
> them.
> 2 - Using that email copy to create a template and modify the output
> so that junk is sent.
>
> I really don't know how they are doing it.
>
Or, you're not checking the security field before sending the email.
--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================
Re: Contact Form Spam
am 24.01.2008 05:28:13 von Shelly
On Jan 23, 11:07 pm, Jerry Stuckle wrote:
> Shelly wrote:
> > On Jan 23, 8:47 pm, Manuel Lemos wrote:
>
> > The email is only sent to the site owner, so the spammer has no way of
> > knowing what the email should look like. That tells me that they have
> > to be going through the form. Yet the proper email has an echo of
> > generated security code. The spam email has that field empty. So,
> > that says he can't be going through the form.
>
> > It seems to me that they must:
> > 1 - Somehow diverting a legitimate email so that copy is sent to
> > them.
> > 2 - Using that email copy to create a template and modify the output
> > so that junk is sent.
>
> > I really don't know how they are doing it.
>
> Or, you're not checking the security field before sending the email.
Of **COURSE** I am. [I even tested it :-) --- and many times].
Filling in all the fields and either leaving that one empty, or with
the wrong info, prevents an email from being sent and the page is
presented again so that the user can fill it in properly.
Jerry, why in the world would I go throught the trouble of generating
a security field if I weren't testing for its accuracy? That would be
just plain stupid.
Shelly
Re: Contact Form Spam
am 24.01.2008 05:28:30 von Jerry Stuckle
Shelly wrote:
> On Jan 23, 11:07 pm, Jerry Stuckle wrote:
>> Shelly wrote:
>>> On Jan 23, 8:47 pm, Manuel Lemos wrote:
>>> The email is only sent to the site owner, so the spammer has no way of
>>> knowing what the email should look like. That tells me that they have
>>> to be going through the form. Yet the proper email has an echo of
>>> generated security code. The spam email has that field empty. So,
>>> that says he can't be going through the form.
>>> It seems to me that they must:
>>> 1 - Somehow diverting a legitimate email so that copy is sent to
>>> them.
>>> 2 - Using that email copy to create a template and modify the output
>>> so that junk is sent.
>>> I really don't know how they are doing it.
>> Or, you're not checking the security field before sending the email.
>
> Of **COURSE** I am. [I even tested it :-) --- and many times].
> Filling in all the fields and either leaving that one empty, or with
> the wrong info, prevents an email from being sent and the page is
> presented again so that the user can fill it in properly.
>
> Jerry, why in the world would I go throught the trouble of generating
> a security field if I weren't testing for its accuracy? That would be
> just plain stupid.
>
> Shelly
>
Shelly,
You said:
"The spam email has that field empty."
So you're obviously not checking it - at least not correctly. If you
were, then you would reject emails with the field empty.
But you never posted any code, so it's hard to tell.
--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================
Re: Contact Form Spam
am 24.01.2008 05:29:59 von Manuel Lemos
Hello,
on 01/24/2008 12:07 AM Shelly said the following:
> The email is only sent to the site owner, so the spammer has no way of
> knowing what the email should look like. That tells me that they have
> to be going through the form. Yet the proper email has an echo of
> generated security code. The spam email has that field empty. So,
> that says he can't be going through the form.
>
> It seems to me that they must:
> 1 - Somehow diverting a legitimate email so that copy is sent to
> them.
> 2 - Using that email copy to create a template and modify the output
> so that junk is sent.
>
> I really don't know how they are doing it.
If you are not using a good CAPTCHA, I am not sure what you mean by
security codes.
Anyway, I suspect that your code has a common vulnerability of contact
forms which is to not properly encode information that goes to message
headers. This means that if the abuser inserts a well throught character
sequences, he may make your script compose a message that uses your mail
server to send spam to anybody in the world.
It is hard to advise without seeing your script. Anyway, I recommend
using a component that knows how to properly encode or escape malicious
character sequences to avoid abuses like your suffering.
I use this MIME message composing and sending class that is well aware
of all the e-mail standards that are necessary to compose messages
properly. You may want to use it to avoid the abuses.
http://www.phpclasses.org/mimemessage
--
Regards,
Manuel Lemos
PHP professionals looking for PHP jobs
http://www.phpclasses.org/professionals/
PHP Classes - Free ready to use OOP components written in PHP
http://www.phpclasses.org/
Re: Contact Form Spam
am 24.01.2008 05:40:02 von Shelly
On Jan 23, 11:29 pm, Manuel Lemos wrote:
> Hello,
>
> on 01/24/2008 12:07 AM Shelly said the following:
>
> > The email is only sent to the site owner, so the spammer has no way of
> > knowing what the email should look like. That tells me that they have
> > to be going through the form. Yet the proper email has an echo of
> > generated security code. The spam email has that field empty. So,
> > that says he can't be going through the form.
>
> > It seems to me that they must:
> > 1 - Somehow diverting a legitimate email so that copy is sent to
> > them.
> > 2 - Using that email copy to create a template and modify the output
> > so that junk is sent.
>
> > I really don't know how they are doing it.
>
> If you are not using a good CAPTCHA, I am not sure what you mean by
> security codes.
>
> Anyway, I suspect that your code has a common vulnerability of contact
> forms which is to not properly encode information that goes to message
> headers. This means that if the abuser inserts a well throught character
> sequences, he may make your script compose a message that uses your mail
> server to send spam to anybody in the world.
>
> It is hard to advise without seeing your script. Anyway, I recommend
> using a component that knows how to properly encode or escape malicious
> character sequences to avoid abuses like your suffering.
>
> I use this MIME message composing and sending class that is well aware
> of all the e-mail standards that are necessary to compose messages
> properly. You may want to use it to avoid the abuses.
>
> http://www.phpclasses.org/mimemessage
>
I use the class htmlMimeMail from http://www.phpguru.org/ by Richard
Heyes. The security code is just a randomly generated string of 6
characters. I am not using a CAPTCHA. I guess I will have to.
Shelly
Re: Contact Form Spam
am 24.01.2008 05:44:49 von Manuel Lemos
Hello,
on 01/24/2008 02:40 AM Shelly said the following:
>>> The email is only sent to the site owner, so the spammer has no way of
>>> knowing what the email should look like. That tells me that they have
>>> to be going through the form. Yet the proper email has an echo of
>>> generated security code. The spam email has that field empty. So,
>>> that says he can't be going through the form.
>>> It seems to me that they must:
>>> 1 - Somehow diverting a legitimate email so that copy is sent to
>>> them.
>>> 2 - Using that email copy to create a template and modify the output
>>> so that junk is sent.
>>> I really don't know how they are doing it.
>> If you are not using a good CAPTCHA, I am not sure what you mean by
>> security codes.
>>
>> Anyway, I suspect that your code has a common vulnerability of contact
>> forms which is to not properly encode information that goes to message
>> headers. This means that if the abuser inserts a well throught character
>> sequences, he may make your script compose a message that uses your mail
>> server to send spam to anybody in the world.
>>
>> It is hard to advise without seeing your script. Anyway, I recommend
>> using a component that knows how to properly encode or escape malicious
>> character sequences to avoid abuses like your suffering.
>>
>> I use this MIME message composing and sending class that is well aware
>> of all the e-mail standards that are necessary to compose messages
>> properly. You may want to use it to avoid the abuses.
>>
>> http://www.phpclasses.org/mimemessage
>>
>
> I use the class htmlMimeMail from http://www.phpguru.org/ by Richard
I have not studied that class. I don't know if it properly encodes
message headers.
> Heyes. The security code is just a randomly generated string of 6
> characters. I am not using a CAPTCHA. I guess I will have to.
That may explain it. Even some CAPTCHAs can be bypassed with good OCR
scripts. But even a basic CAPTCHA can raise the bar hard enough to make
your abuser give up.
--
Regards,
Manuel Lemos
PHP professionals looking for PHP jobs
http://www.phpclasses.org/professionals/
PHP Classes - Free ready to use OOP components written in PHP
http://www.phpclasses.org/
Re: Contact Form Spam
am 24.01.2008 05:49:38 von Shelly
On Jan 23, 11:44 pm, Manuel Lemos wrote:
> Hello,
>
> on 01/24/2008 02:40 AM Shelly said the following:
>
>
>
> >>> The email is only sent to the site owner, so the spammer has no way of
> >>> knowing what the email should look like. That tells me that they have
> >>> to be going through the form. Yet the proper email has an echo of
> >>> generated security code. The spam email has that field empty. So,
> >>> that says he can't be going through the form.
> >>> It seems to me that they must:
> >>> 1 - Somehow diverting a legitimate email so that copy is sent to
> >>> them.
> >>> 2 - Using that email copy to create a template and modify the output
> >>> so that junk is sent.
> >>> I really don't know how they are doing it.
> >> If you are not using a good CAPTCHA, I am not sure what you mean by
> >> security codes.
>
> >> Anyway, I suspect that your code has a common vulnerability of contact
> >> forms which is to not properly encode information that goes to message
> >> headers. This means that if the abuser inserts a well throught character
> >> sequences, he may make your script compose a message that uses your mail
> >> server to send spam to anybody in the world.
>
> >> It is hard to advise without seeing your script. Anyway, I recommend
> >> using a component that knows how to properly encode or escape malicious
> >> character sequences to avoid abuses like your suffering.
>
> >> I use this MIME message composing and sending class that is well aware
> >> of all the e-mail standards that are necessary to compose messages
> >> properly. You may want to use it to avoid the abuses.
>
> >>http://www.phpclasses.org/mimemessage
>
> > I use the class htmlMimeMail fromhttp://www.phpguru.org/by Richard
>
> I have not studied that class. I don't know if it properly encodes
> message headers.
>
> > Heyes. The security code is just a randomly generated string of 6
> > characters. I am not using a CAPTCHA. I guess I will have to.
>
> That may explain it. Even some CAPTCHAs can be bypassed with good OCR
> scripts. But even a basic CAPTCHA can raise the bar hard enough to make
> your abuser give up.
But with or without a CAPTCHA, they still need to get the text that is
checked by me before sending the email. I put that text (both what I
asked for and what they put in) into the email that is sent. The
email that we received from them had those fields empty. Wouldn't
they have been filled with their correct determination of the code?
Re: Contact Form Spam
am 24.01.2008 05:57:39 von Manuel Lemos
Hello,
on 01/24/2008 02:49 AM Shelly said the following:
>>>>> The email is only sent to the site owner, so the spammer has no way of
>>>>> knowing what the email should look like. That tells me that they have
>>>>> to be going through the form. Yet the proper email has an echo of
>>>>> generated security code. The spam email has that field empty. So,
>>>>> that says he can't be going through the form.
>>>>> It seems to me that they must:
>>>>> 1 - Somehow diverting a legitimate email so that copy is sent to
>>>>> them.
>>>>> 2 - Using that email copy to create a template and modify the output
>>>>> so that junk is sent.
>>>>> I really don't know how they are doing it.
>>>> If you are not using a good CAPTCHA, I am not sure what you mean by
>>>> security codes.
>>>> Anyway, I suspect that your code has a common vulnerability of contact
>>>> forms which is to not properly encode information that goes to message
>>>> headers. This means that if the abuser inserts a well throught character
>>>> sequences, he may make your script compose a message that uses your mail
>>>> server to send spam to anybody in the world.
>>>> It is hard to advise without seeing your script. Anyway, I recommend
>>>> using a component that knows how to properly encode or escape malicious
>>>> character sequences to avoid abuses like your suffering.
>>>> I use this MIME message composing and sending class that is well aware
>>>> of all the e-mail standards that are necessary to compose messages
>>>> properly. You may want to use it to avoid the abuses.
>>>> http://www.phpclasses.org/mimemessage
>>> I use the class htmlMimeMail fromhttp://www.phpguru.org/by Richard
>> I have not studied that class. I don't know if it properly encodes
>> message headers.
>>
>>> Heyes. The security code is just a randomly generated string of 6
>>> characters. I am not using a CAPTCHA. I guess I will have to.
>> That may explain it. Even some CAPTCHAs can be bypassed with good OCR
>> scripts. But even a basic CAPTCHA can raise the bar hard enough to make
>> your abuser give up.
>
> But with or without a CAPTCHA, they still need to get the text that is
> checked by me before sending the email. I put that text (both what I
> asked for and what they put in) into the email that is sent. The
> email that we received from them had those fields empty. Wouldn't
> they have been filled with their correct determination of the code?
It is hard to even understand the context of all what you are saying
without seeing your code.
If you put the text in the form page, it is very easy to retrieve the
page, get the code and emulate the form submission with the code in it.
With CAPTCHA that would be harder.
If you say you verify the presence of the correct code, maybe you are
not doing it correctly.
--
Regards,
Manuel Lemos
PHP professionals looking for PHP jobs
http://www.phpclasses.org/professionals/
PHP Classes - Free ready to use OOP components written in PHP
http://www.phpclasses.org/
Re: Contact Form Spam
am 24.01.2008 06:03:11 von Shelly
On Jan 23, 11:57 pm, Manuel Lemos wrote:
> Hello,
>
> on 01/24/2008 02:49 AM Shelly said the following:
>
>
>
> >>>>> The email is only sent to the site owner, so the spammer has no way of
> >>>>> knowing what the email should look like. That tells me that they have
> >>>>> to be going through the form. Yet the proper email has an echo of
> >>>>> generated security code. The spam email has that field empty. So,
> >>>>> that says he can't be going through the form.
> >>>>> It seems to me that they must:
> >>>>> 1 - Somehow diverting a legitimate email so that copy is sent to
> >>>>> them.
> >>>>> 2 - Using that email copy to create a template and modify the output
> >>>>> so that junk is sent.
> >>>>> I really don't know how they are doing it.
> >>>> If you are not using a good CAPTCHA, I am not sure what you mean by
> >>>> security codes.
> >>>> Anyway, I suspect that your code has a common vulnerability of contact
> >>>> forms which is to not properly encode information that goes to message
> >>>> headers. This means that if the abuser inserts a well throught character
> >>>> sequences, he may make your script compose a message that uses your mail
> >>>> server to send spam to anybody in the world.
> >>>> It is hard to advise without seeing your script. Anyway, I recommend
> >>>> using a component that knows how to properly encode or escape malicious
> >>>> character sequences to avoid abuses like your suffering.
> >>>> I use this MIME message composing and sending class that is well aware
> >>>> of all the e-mail standards that are necessary to compose messages
> >>>> properly. You may want to use it to avoid the abuses.
> >>>>http://www.phpclasses.org/mimemessage
> >>> I use the class htmlMimeMail fromhttp://www.phpguru.org/byRichard
> >> I have not studied that class. I don't know if it properly encodes
> >> message headers.
>
> >>> Heyes. The security code is just a randomly generated string of 6
> >>> characters. I am not using a CAPTCHA. I guess I will have to.
> >> That may explain it. Even some CAPTCHAs can be bypassed with good OCR
> >> scripts. But even a basic CAPTCHA can raise the bar hard enough to make
> >> your abuser give up.
>
> > But with or without a CAPTCHA, they still need to get the text that is
> > checked by me before sending the email. I put that text (both what I
> > asked for and what they put in) into the email that is sent. The
> > email that we received from them had those fields empty. Wouldn't
> > they have been filled with their correct determination of the code?
>
> It is hard to even understand the context of all what you are saying
> without seeing your code.
>
> If you put the text in the form page, it is very easy to retrieve the
> page, get the code and emulate the form submission with the code in it.
> With CAPTCHA that would be harder.
Exactly. If they put the code in it (assuming they got it), and since
I put it in the email that is sent (both what they put in and what I
asked for), why would the email they send not have anything in either
field in the email?
>
> If you say you verify the presence of the correct code, maybe you are
> not doing it correctly.
It is done correctly. I tested this about twenty times. It only
succeeds if the code that is typed in is the same as the one asked
for. BTW, every time the page is presented there is a different set
of 6 characters.
Shelly
Re: Contact Form Spam
am 24.01.2008 06:09:39 von Manuel Lemos
Hello,
on 01/24/2008 03:03 AM Shelly said the following:
>> If you put the text in the form page, it is very easy to retrieve the
>> page, get the code and emulate the form submission with the code in it.
>> With CAPTCHA that would be harder.
>
> Exactly. If they put the code in it (assuming they got it), and since
> I put it in the email that is sent (both what they put in and what I
> asked for), why would the email they send not have anything in either
> field in the email?
>
>
>> If you say you verify the presence of the correct code, maybe you are
>> not doing it correctly.
>
> It is done correctly. I tested this about twenty times. It only
> succeeds if the code that is typed in is the same as the one asked
> for. BTW, every time the page is presented there is a different set
> of 6 characters.
It seems you have a bug that only you can figure because only you know
your code. Maybe we can help you can show your code.
--
Regards,
Manuel Lemos
PHP professionals looking for PHP jobs
http://www.phpclasses.org/professionals/
PHP Classes - Free ready to use OOP components written in PHP
http://www.phpclasses.org/
Re: Contact Form Spam
am 24.01.2008 06:21:48 von Shelly
On Jan 24, 12:09 am, Manuel Lemos wrote:
> Hello,
>
> on 01/24/2008 03:03 AM Shelly said the following:
>
>
>
> >> If you put the text in the form page, it is very easy to retrieve the
> >> page, get the code and emulate the form submission with the code in it.
> >> With CAPTCHA that would be harder.
>
> > Exactly. If they put the code in it (assuming they got it), and since
> > I put it in the email that is sent (both what they put in and what I
> > asked for), why would the email they send not have anything in either
> > field in the email?
>
> >> If you say you verify the presence of the correct code, maybe you are
> >> not doing it correctly.
>
> > It is done correctly. I tested this about twenty times. It only
> > succeeds if the code that is typed in is the same as the one asked
> > for. BTW, every time the page is presented there is a different set
> > of 6 characters.
>
> It seems you have a bug that only you can figure because only you know
> your code. Maybe we can help you can show your code.
>
> --
>
> Regards,
> Manuel Lemos
>
> PHP professionals looking for PHP jobshttp://www.phpclasses.org/professionals/
>
> PHP Classes - Free ready to use OOP components written in PHPhttp://www.phpclasses.org/
The calling code is (The constants are defined earlier. Also, $fld is
an instance of a class that contains information about all of the
fields on the form. The last three are not on the form and the
security field was not part of $fld.)
====================
$mail = new htmlMimeMail();
$mail->setFrom(MAIL_FROM);
$mail->setBcc(MAIL_CC);
$mail->setSubject(MAIL_SUBJECT);
$i = 0;
$message = "";
The htmlMimeMail is part of the htmlMimeMail package (http://
www.phpguru.org/)
It is rather long, but can be seen at that site.
Re: Contact Form Spam
am 24.01.2008 06:33:31 von Manuel Lemos
Hello,
on 01/24/2008 03:21 AM Shelly said the following:
> The calling code is (The constants are defined earlier. Also, $fld is
> an instance of a class that contains information about all of the
> fields on the form. The last three are not on the form and the
> security field was not part of $fld.)
> ====================
> $mail = new htmlMimeMail();
> $mail->setFrom(MAIL_FROM);
> $mail->setBcc(MAIL_CC);
> $mail->setSubject(MAIL_SUBJECT);
> $i = 0;
> $message = "";
>
> $html = '
I don't know if that is enough to explain it, but you are not encoding
the values that you insert in the HTML message.
If any values start with < the mail program will process as a tag and
may not render anything. So the actual code may be there but is not
being displayed because it is taken as a tag.
Even parts of your static HTML will be omitted like this:
' '
All you need to do is to use HtmlSpecialChars() to properly encode your
values in HTML.
--
Regards,
Manuel Lemos
PHP professionals looking for PHP jobs
http://www.phpclasses.org/professionals/
PHP Classes - Free ready to use OOP components written in PHP
http://www.phpclasses.org/
Re: Contact Form Spam
am 24.01.2008 10:23:04 von Rob
On Jan 24, 5:33=A0am, Manuel Lemos wrote:
> Hello,
>
> on 01/24/2008 03:21 AM Shelly said the following:
>
>
>
>
>
> > The calling code is (The constants are defined earlier. =A0Also, $fld is=
> > an instance of a class that contains information about all of the
> > fields on the form. =A0The last three are not on the form and the
> > security field was not part of $fld.)
> > ====================
> > $mail =3D new htmlMimeMail();
> > $mail->setFrom(MAIL_FROM);
> > $mail->setBcc(MAIL_CC);
> > $mail->setSubject(MAIL_SUBJECT);
> > $i =3D 0;
> > $message =3D "";
>
> > $html =3D '' .
> > =A0 =A0'From: ' . MAIL_FROM =A0. '
ROM .
> > '.com> ' .
> > 'Sent: ' . MAIL_SENT . " " .
> > 'To: ' . MAIL_TO . " " .
> > 'Subject: ' . MAIL_SUBJECT . " " .
> > '
';
>
> I don't know if that is enough to explain it, but you are not encoding
> the values that you insert in the HTML message.
>
> If any values start with < the mail program will process as a tag and
> may not render anything. So the actual code may be there but is not
> being displayed because it is taken as a tag.
>
> Even parts of your static HTML will be omitted like this:
>
> ' '
>
> All you need to do is to use HtmlSpecialChars() to properly encode your
> values in HTML.
>
> --
>
> Regards,
> Manuel Lemos
>
> PHP professionals looking for PHP jobshttp://www.phpclasses.org/profession=
als/
>
> PHP Classes - Free ready to use OOP components written in PHPhttp://www.ph=
pclasses.org/- Hide quoted text -
>
> - Show quoted text -
Shelly, I haven't read this (long) thread in detail, but I think you
have a problem I've seen before.
Basically, what stops a spammer looking at the HTML on your page, then
posting content back to the form processor contained in the 'ACTION'?
By doing this, they bypass your page security, and can pass any
information they want to.
You can correct this by generating a known field on the form, lets say
the date and time, or a unique ID, then checking this as the form
results come back.
There is NO SUBSTITUTE for checking the integrity of the data returned
from a form, even if you have client side checking in place.
I may be barking up the wrong tree here, but it certainly sounds like
your problem.
Rob.
Re: Contact Form Spam
am 24.01.2008 10:39:14 von Dikkie Dik
>> Or, you're not checking the security field before sending the email.
>
> Of **COURSE** I am. [I even tested it :-) --- and many times].
Well, Jerry is right, you know. If the mail gets sent without the field
being filled in, there is something wrong with your check. AND with your
tests.
> Filling in all the fields and either leaving that one empty, or with
> the wrong info, prevents an email from being sent and the page is
> presented again so that the user can fill it in properly.
Take one step back. A code is presented (generated by your page). That
code has to be stored somewhere to do the check later, doesn't it? Where
do you store it? In the session? In that case, the code in the session
is an empty string (not true, but your server settings can make it act
like it) whenever you post the form directly (thereby starting a
session) without first seeing the form and the code.
Also, you say there are no addresses on the form. Any header field (like
a subject) will do to do spamming, if you don't check things. However,
if it sent to you and your address is not in the page, it is most likely
that your security mechanism just fails.
>
> Jerry, why in the world would I go throught the trouble of generating
> a security field if I weren't testing for its accuracy? That would be
> just plain stupid.
To err is human, not stupid. To ask questions can even be considered
wise. To point others at there errors can be either helpful or annoying.
You decide ;)
Good luck!
Re: Contact Form Spam
am 24.01.2008 11:06:13 von Toby A Inkster
Shelly wrote:
> $_POST['securityHidden']
This is your problem.
--
Toby A Inkster BSc (Hons) ARCS
[Geek of HTML/SQL/Perl/PHP/Python/Apache/Linux]
[OS: Linux 2.6.17.14-mm-desktop-9mdvsmp, up 24 days, 21:18.]
CSS to HTML Compiler
http://tobyinkster.co.uk/blog/2008/01/22/css-compile/
Re: Contact Form Spam
am 24.01.2008 13:47:07 von Shelly
On Jan 24, 5:06 am, Toby A Inkster
wrote:
> Shelly wrote:
> > $_POST['securityHidden']
>
> This is your problem.
>
Why is this the problem? Here is the code:
$securityCodeDisplay; ?>:
I display a space separated version of the $securityCode
($securityCodeDisplay) and store the code in a hidden field,
securityHidden, on the form so that when it posts back, I can compare
it with the value that they type in text field, securityCode.
If this is the problem, why is the problem and how do I change it?
Shelly
Re: Contact Form Spam
am 24.01.2008 13:53:06 von Jerry Stuckle
Shelly wrote:
> On Jan 24, 5:06 am, Toby A Inkster
> wrote:
>> Shelly wrote:
>>> $_POST['securityHidden']
>> This is your problem.
>>
>
> Why is this the problem? Here is the code:
>
>
>
> $securityCodeDisplay; ?>:
>
>
>
>
> I display a space separated version of the $securityCode
> ($securityCodeDisplay) and store the code in a hidden field,
> securityHidden, on the form so that when it posts back, I can compare
> it with the value that they type in text field, securityCode.
>
> If this is the problem, why is the problem and how do I change it?
>
> Shelly
>
Shelly,
And exactly what is the problem with me creating a form with an empty
SecurityCode field, then posting it back to you?
Your way of doing it is like locking valuables in a safe then writing
the combination on the front of the safe.
--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================
Re: Contact Form Spam
am 24.01.2008 14:01:42 von Shelly
On Jan 24, 4:23 am, Rob wrote:
> On Jan 24, 5:33 am, Manuel Lemos wrote:
>
>
>
> > Hello,
>
> > on 01/24/2008 03:21 AM Shelly said the following:
>
> > > The calling code is (The constants are defined earlier. Also, $fld is
> > > an instance of a class that contains information about all of the
> > > fields on the form. The last three are not on the form and the
> > > security field was not part of $fld.)
> > > ====================
> > > $mail = new htmlMimeMail();
> > > $mail->setFrom(MAIL_FROM);
> > > $mail->setBcc(MAIL_CC);
> > > $mail->setSubject(MAIL_SUBJECT);
> > > $i = 0;
> > > $message = "";
>
> > > $html = '' .
> > > 'From: ' . MAIL_FROM . '
> > > '.com> ' .
> > > 'Sent: ' . MAIL_SENT . " " .
> > > 'To: ' . MAIL_TO . " " .
> > > 'Subject: ' . MAIL_SUBJECT . " " .
> > > '
';
>
> > I don't know if that is enough to explain it, but you are not encoding
> > the values that you insert in the HTML message.
>
> > If any values start with < the mail program will process as a tag and
> > may not render anything. So the actual code may be there but is not
> > being displayed because it is taken as a tag.
>
> > Even parts of your static HTML will be omitted like this:
>
> > ' '
>
> > All you need to do is to use HtmlSpecialChars() to properly encode your
> > values in HTML.
>
> > --
>
> > Regards,
> > Manuel Lemos
>
> > PHP professionals looking for PHP jobshttp://www.phpclasses.org/professionals/
>
> > PHP Classes - Free ready to use OOP components written in PHPhttp://www.phpclasses.org/-Hide quoted text -
>
> > - Show quoted text -
>
> Shelly, I haven't read this (long) thread in detail, but I think you
> have a problem I've seen before.
>
> Basically, what stops a spammer looking at the HTML on your page, then
> posting content back to the form processor contained in the 'ACTION'?
>
> By doing this, they bypass your page security, and can pass any
> information they want to.
>
> You can correct this by generating a known field on the form, lets say
> the date and time, or a unique ID, then checking this as the form
> results come back.
>
> There is NO SUBSTITUTE for checking the integrity of the data returned
> from a form, even if you have client side checking in place.
>
> I may be barking up the wrong tree here, but it certainly sounds like
> your problem.
>
> Rob.
Wow! I just learned something very important. Thanks. I looked at
the html generated (view source) and there it is. The hidden field,
its name, and its value are all to see. That means that they can
generate a form and put in even a null field in that area and my check
would fail because it matches. So, where do I hide the value to be
checked? Do I create a session variable and put its value there and
then check the returned value against that? (That seems to be
equivalent to the dste and time).
Shelly
Re: Contact Form Spam
am 24.01.2008 14:24:22 von Toby A Inkster
Shelly wrote:
> Why is this the problem?
>
>
> name="securityHidden">
The problem is twofold:
1. The security code might be in a hidden field, but the field can still
be seen quite easily by viewing the source code to the page.
2. An even bigger problem: the client can change the contents of the
securityHidden field -- change it to "" for instance.
--
Toby A Inkster BSc (Hons) ARCS
[Geek of HTML/SQL/Perl/PHP/Python/Apache/Linux]
[OS: Linux 2.6.17.14-mm-desktop-9mdvsmp, up 25 days, 33 min.]
CSS to HTML Compiler
http://tobyinkster.co.uk/blog/2008/01/22/css-compile/
Re: Contact Form Spam
am 24.01.2008 15:16:39 von Shelly
On Jan 24, 8:24 am, Toby A Inkster
wrote:
> Shelly wrote:
> > Why is this the problem?
>
> >
> > name="securityHidden">
>
> The problem is twofold:
>
> 1. The security code might be in a hidden field, but the field can still
> be seen quite easily by viewing the source code to the page.
>
> 2. An even bigger problem: the client can change the contents of the
> securityHidden field -- change it to "" for instance.
>
Thank you all for your help. I changed the storage mechanism to a
session variable and removed the hidden field from the form. I now
check the typed in version against that session variable's contents.
That variable gets changed with each presentation of the form.
Hopefully that fixes the problem. Thanks again everyone.
> I looked at
> the html generated (view source) and there it is. The hidden field,
> its name, and its value are all to see. That means that they can
> generate a form and put in even a null field in that area and my check
> would fail because it matches. So, where do I hide the value to be
> checked? Do I create a session variable and put its value there and
> then check the returned value against that?
>
I use the ip address to create the filename and to store anti spam bot
code as a flat file - and then read the code in on the next page .
While its certainly not impossible 2 or more users will be surfing your
website using the same ip address - the chances that more than one user
will be using the contact form at that precise moment is quite remote
even if its a fairly busy website as the vast majority of users are
'surfers' and not 'contactors' .
www.jpgimage.co.uk/contact.php
BTW: one of the tricks IMHO is to write your own image code that you can
then use on any of your own websites - and despite what you might like
to think its not that hard once you learn some GD basics .
Re: Contact Form Spam
am 24.01.2008 21:00:28 von unknown
Post removed (X-No-Archive: yes)
Re: Contact Form Spam
am 25.01.2008 13:48:19 von Andy
Just a heads up Shelly
Theres a free trial online of the pForms automated forms validator at
http://www.streamforensics.com the download link is on their introduction
page.(sorry I forget the actual page name)
It writes all the PHP code for you.
It is only a trial and you do need to buy the "data minion" software to
keep using it but its very interesting stuff for anyone with any sort
of web form. You might find it useful.
andy
Re: Contact Form Spam
am 25.01.2008 17:25:18 von adwatson
I kind of like the new test you've been seeing here and there where it
says something like "2+2 = " and you enter the answer, seems like it
strikes more a balance between protection from bots and making the
form accessible to screen readers, etc.
---
www.NEXCESS.NET - Shared/Reseller Hosting
www.EliteRax.com - Dedicated Servers, Server Clusters
www.MaxVPS.com - Virtual Private Servers
- Great prices, Great service - check us out!
On Jan 24, 3:00 pm, Michael Vilain wrote:
> In article , Manuel Lemos
> wrote:
>
>
>
> > Hello,
>
> > on 01/24/2008 02:40 AM Shelly said the following:
> > >>> The email is only sent to the site owner, so the spammer has no way of
> > >>> knowing what the email should look like. That tells me that they have
> > >>> to be going through the form. Yet the proper email has an echo of
> > >>> generated security code. The spam email has that field empty. So,
> > >>> that says he can't be going through the form.
> > >>> It seems to me that they must:
> > >>> 1 - Somehow diverting a legitimate email so that copy is sent to
> > >>> them.
> > >>> 2 - Using that email copy to create a template and modify the output
> > >>> so that junk is sent.
> > >>> I really don't know how they are doing it.
> > >> If you are not using a good CAPTCHA, I am not sure what you mean by
> > >> security codes.
>
> > >> Anyway, I suspect that your code has a common vulnerability of contact
> > >> forms which is to not properly encode information that goes to message
> > >> headers. This means that if the abuser inserts a well throught character
> > >> sequences, he may make your script compose a message that uses your mail
> > >> server to send spam to anybody in the world.
>
> > >> It is hard to advise without seeing your script. Anyway, I recommend
> > >> using a component that knows how to properly encode or escape malicious
> > >> character sequences to avoid abuses like your suffering.
>
> > >> I use this MIME message composing and sending class that is well aware
> > >> of all the e-mail standards that are necessary to compose messages
> > >> properly. You may want to use it to avoid the abuses.
>
> > >>http://www.phpclasses.org/mimemessage
>
> > > I use the class htmlMimeMail fromhttp://www.phpguru.org/by Richard
>
> > I have not studied that class. I don't know if it properly encodes
> > message headers.
>
> > > Heyes. The security code is just a randomly generated string of 6
> > > characters. I am not using a CAPTCHA. I guess I will have to.
>
> > That may explain it. Even some CAPTCHAs can be bypassed with good OCR
> > scripts. But even a basic CAPTCHA can raise the bar hard enough to make
> > your abuser give up.
>
> I use a very simple trick. Put a HIDDEN field with an obvious name like
> "COUNTRY" or "POSTAL CODE" or whatever giving it an initially blank
> value. Check in the post processing for the form to see that it's
> blank, meaning the form was filled out by a browser with a human sitting
> in front of it. If a bot filled out the form, chances are it put in a
> value. Throw those submissions away and do nothing. Mail the others.
>
> --
> DeeDee, don't press that button! DeeDee! NO! Dee...