Textpattern CMS support forum
You are not logged in. Register | Login | Help
- Topics: Active | Unanswered
Pages: 1
Captcha Bypass
About 4 or 5 days ago, I added a “captcha” to my website, sitting between Apache and Txp. For blog entries and file downloads, it presents a button to press before proceeding. So far, it stops about 98.5% of the access attempts. I’d call that a success! I have also seen it bypassed already:
- Broadcom server (Google cloud sublet) loads captcha page with HTTP/1.1
- 5 seconds later, reloads captcha page with HTTP/2
- 1 second later, loads favicon with HTTP/2
- 4 seconds later, presses button and loads page with all resources using HTTP/3
- 10 hours later, returns with different nearby Broadcom server IP address, presses button, and loads page using HTTP/3. Loads no other resources.
#mildlyinteresting
Since /file_download/ is served through Txp, I use the same system to prevent deep-linking to files. Images are more complicated, since some are OpenGraph images, and htaccess doesn’t know which are which without a specific list to be maintained – yuck.
Offline
Re: Captcha Bypass
Just a heads up that there are open source captcha alternatives. ie
- trycap.dev/
- altcha.org/open-source-captcha/
- european-alternatives.eu/alternative-to/recaptcha which lists GDPR compatible ones.
Yiannis
——————————
NeMe | hblack.art | EMAP | A Sea change | Toolkit of Care
I do my best editing after I click on the submit button.
Offline
Re: Captcha Bypass
This is 69 lines of php+html and works fine for its intended purpose. I am having a hard time believing anything else will be easier to maintain. Moving the html part into Txp will make it even smaller.
Offline
Pages: 1