Products Forum

Roy · Guest

The antibot 1.0 do not fulfil it's goal. The hashing does not useful anyway. Attacker can simpily submitting the captured hash value and the string together.

e.g.
http://www.vorras.com/cgi-bin/demo/antibot/pythonreply.cgi?sequence=hnjdb&realsequence=c110870b6595cb9533dac39308f1c57fc630d34a

For a better solution, we should compare value in session.
This is just a suggestion. You may ignore it but it is too easy to flood the polling if we use this antibot.

haris · Site Admin Joined: 22 Aug 2002 Posts: 40

Hi,

How will the attacker get the string though? The attacker is not human, and is not supposed to be able to read the string itself. Therefore the attacker cannot form the URL you mention in your message.

Haris

Guest · Posted: Fri Feb 25, 2005 1:53 pm Post subject:

Yes, the attacker is a bot, but the bot is made by human.

Just keep on posting the same string, and this Vorras Antibot will accept the polling.

That is why you want to make a image generation with noise. Because you don't want the bot to grep any string from the image name, and even the binary of the image to guess the string. (number)

Putting the hash inside the page has violate the rule. The bot can grep the hash, and the number, It is easy to flood the polling.

So, why not storing the number somewhere else but let client browser know it ?

Roy · Guest

Yes, the attacker is a bot, but the bot is made by human.

Just keep on posting the same string, and this Vorras Antibot will accept the polling.

That is why you want to make a image generation with noise. Because you don't want the bot to grep any string from the image name, and even the binary of the image to guess the string. (number)

Putting the hash inside the page has violate the rule. The bot can grep the hash, and the number, It is easy to flood the polling.

So, why not storing the number somewhere else but let client browser know it ?

Guest · Posted: Fri Feb 25, 2005 2:02 pm Post subject:

Actually, we do not need any bot to attack it too ! The following code showing that no bot is need. For flooding the polling, attacker can implement the two string pair in their bot. (do not need any guessing either !)

<table border=0 cellspacing=0 cellpadding=1><tr>
<td valign="middle" nowrap class="content">
Simply Press submit to bloom it.<br><br>
<form action=http://www.vorras.com/cgi-bin/demo/antibot/pythonreply.cgi method=POST>
Always use the same number</font>  <br>
<input type=text size=7 maxlength=15 name=sequence value=hnjdb><br>
Always use the same matched hash<br>
<input type=text name=realsequence value="c110870b6595cb9533dac39308f1c57fc630d34a"><br>
<input type="Submit" value="Submit">
</form>
</td></tr></table>

Secret Kill · Guest

Hashing itself cannot gurantee security, hashing is as simple as a one-way function.

If you the server uses hash used statically without dynamic generation, it's useless.

Secret Kill · Guest

Hashing itself cannot gurantee security, hashing is as simple as a one-way function.

If you the server uses hash used statically without dynamic generation, it's useless.