Craft Posted August 28 Share Posted August 28 Hello, A guy is using a script to register many accounts without accessing my website's registration page, and his script passes the captcha! Check this screenshot. Any solution for that? 0 Quote Link to comment Share on other sites More sharing options...
slim Posted August 29 Share Posted August 29 You obviously didnt hit search before posting this. What makes you assume they are bypassing captcha, rather than solving it? 0 Quote Link to comment Share on other sites More sharing options...
bear Posted August 29 Share Posted August 29 If it *was* bypassing the registration page and submitting to the script directly, that would leave CAPTCHA out of the process. That's on the registration page. The rapid fire nature of this issue, with no discernable exploit so far, definitely feels automated and directly submitted. Why remains a mystery. 0 Quote Link to comment Share on other sites More sharing options...
Craft Posted August 29 Author Share Posted August 29 9 hours ago, slim said: You obviously didnt hit search before posting this. What makes you assume they are bypassing captcha, rather than solving it? Thanks for your comment, but it seems you haven't heard about this new hacking script before. The captcha prevents the robots from creating fake accounts/orders, but this new hacking script is passing the captcha and completing its order! By the way, Captcha is already enabled on my registration page and every day I receive fake orders/accounts. 0 Quote Link to comment Share on other sites More sharing options...
Craft Posted August 29 Author Share Posted August 29 3 hours ago, bear said: If it *was* bypassing the registration page and submitting to the script directly, that would leave CAPTCHA out of the process. That's on the registration page. The rapid fire nature of this issue, with no discernable exploit so far, definitely feels automated and directly submitted. Why remains a mystery. That's correct, but how can we solve this issue?!! 0 Quote Link to comment Share on other sites More sharing options...
bear Posted August 29 Share Posted August 29 Check out this thread. A few pages in there's something in Cloudflare that's been effective, according to users in that. 0 Quote Link to comment Share on other sites More sharing options...
Craft Posted August 29 Author Share Posted August 29 42 minutes ago, bear said: Check out this thread. A few pages in there's something in Cloudflare that's been effective, according to users in that. Thank you. I tried this code in the .htaccess file and it works fine <IfModule mod_rewrite.c> RewriteEngine On # Check if the User-Agent matches RewriteCond %{HTTP_USER_AGENT} "Mozilla/5.0 \(Windows NT 10.0; Win64; x64; rv:127.0\) Gecko/20100101 Firefox/127.0" # Check if the request method is POST RewriteCond %{REQUEST_METHOD} POST # Check if the URL is register.php RewriteCond %{REQUEST_URI} register.php$ # Deny access by returning a 403 Forbidden status RewriteRule .* - [F] </IfModule> 0 Quote Link to comment Share on other sites More sharing options...
bear Posted August 29 Share Posted August 29 That user agent matches anyone using the version of Firefox one or two below current (129). If legitimate users try to order with that, they can't. Not a very good fix, I'd suggest. 1 Quote Link to comment Share on other sites More sharing options...
slim Posted August 29 Share Posted August 29 Upgrade to the beta and implement v3 captcha. 0 Quote Link to comment Share on other sites More sharing options...
bear Posted August 29 Share Posted August 29 30 minutes ago, slim said: Upgrade to the beta and implement v3 captcha. Unless it's bypassing the register page as suspected...meaning no CAPTCHA would fix it, new or old. 0 Quote Link to comment Share on other sites More sharing options...
slim Posted August 29 Share Posted August 29 Just now, bear said: Unless it's bypassing the register page as suspected...meaning no CAPTCHA would fix it, new or old. I have two WHMCS installs, both were getting hammered, the second I installed the beta with v3 captcha, it stopped. If they were bypassing the register page, then there is a bug in WHMCS, which they may have also fixed in the beta. Either way, not a single fake rego since installing and configuring v3 captcha. 1 Quote Link to comment Share on other sites More sharing options...
bear Posted August 30 Share Posted August 30 As a guess they fixed something in the BETA and the new captcha is the "explanation" for it working. Good to know it's fixed, at least for now. 0 Quote Link to comment Share on other sites More sharing options...
Craft Posted August 30 Author Share Posted August 30 15 hours ago, bear said: That user agent matches anyone using the version of Firefox one or two below current (129). If legitimate users try to order with that, they can't. Not a very good fix, I'd suggest. Yes you are correct, after testing the htaccess code for 24 hours, it prevented 60% of the fake accounts, but not 100% 0 Quote Link to comment Share on other sites More sharing options...
bear Posted August 30 Share Posted August 30 17 minutes ago, Craft said: it prevented 60% of the fake accounts, but not 100% And the user agent was unchanged in the ones that got through? Be my guess it was a more recent FF version.... 0 Quote Link to comment Share on other sites More sharing options...
HostMaria Posted August 31 Share Posted August 31 Good thread! Having the same issues. Will switch over to recaptcha v3, as well. Question: what is the easiest way to remove these "0 (0)" accounts? Best! H 0 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.