Hacking phpBB 2 : Memasang CAPTCHA Anti Spam di phpBB 2

Diposting pada April 9, 2007 | Awan: Information Technology | oleh : sunu wibirama.

Mungkin artikel ini udah jadul banget ya. Tapi yang penting bukan jadul atau enggaknya. Semoga bisa menjadi pembelajaran buat kita juga, bahwa Open Source Software tidak hanya membawa keuntungan, namun menghajatkan kepada kita pula untuk selalu siap menghadapi konsekuensi keusilan-keusilan dari para “praktikan-praktikan” di laboratorium dunia maya….

Oke. Kita mulai saja, ya ! Banyak forum diskusi yang kebobolan posting sampah (spam) karena developer forum diskusi tersebut tidak melengkapi form pendaftaran forum diskusi dengan CAPTCHA. Berikut ini, kita akan memasang CAPTCHA pada PHPBB 2 (seri lama, kalo yang baru mah sudah lebih tangguh menghadapi spam, atuh ….).

Langkah-langkahnya sebagai berikut :

1. Lakukan backup script phpBB yang akan kita hack. Beberapa script yang akan kita ubah antara lain :
a. File : /phpBB/templates/subSilver/profile_add_body.tpl.
b. File : /phpBB/includes/usercp_register.php
Kami tidak bertanggungjawab apabila terjadi kerusakan-kerusakan pada forum Anda, setelah Anda mengikuti tutorial ini.
2. Download script CAPTCHA open source, di http://www.puremango.co.uk/freecap1.4.1.zip
Yup, kita akan menggunakan script freecap untuk menghandle tampilan CAPTCHA di forum diskusi kita nantinya. Setelah di download, segera extract dan rename foldernya dengan nama “freecap”.

3. Edit script di freecap.php. Beberapa hal yang harus di edit adalah :
a. Konfigurasikan array site_tag sesuai dengan nama situs Anda. Hal ini untuk mencegah supaya orang tidak terkecoh mengisikan form registrasi untuk para spammer dan mencuri username dan password mereka. Contohnya sebagai berikut :

$site_tags[0] = “”;
$site_tags[1] = “For Access to MYDOMAIN.COM”;

Membiarkan variabel yang pertama kosong akan membantu mencegah text menghalangi image CAPTCHA yang akan dirender
b. Isikan hash function, khusus untuk PHP seri 4.3 ke atas, isikan dengan isian sebagai berikut :

$hash_func = “sha1″;

Untuk PHP seri lebih rendah isikan dengan isian berikut ini :

$hash_func = “crc32″;

c. Ganti Merge Type. Isikan dengan angka 1, supaya image yang dirender bisa terbaca dengan baik.

$merge_type = 1;

d. Simpan freecap.php

4. Upload folder freecap di bawah folder forum Anda, sehingga dalam url akan terlihat seperti ini :

http://namasitusanda.com/forum/freecap

5. Tes freecap.php dengan cara mengakses url di bawah ini :

http://namasitusanda.com/forum/freecap/freecap.php

Kalo image CAPTCHA anda sudah terender dengan baik , selamat ! Anda sudah menempuh satu langkah instalasi.

6. Saatnya melakukan hacking pada script phpBB di webserver Anda ! Siapkan texteditor yang baik, karena kita akan sedikit bermain-main dengan nomer-nomer baris script phpBB. Beberapa yang harus di edit antara lain :
a. Buka file /phpBB/templates/subSilver/profile_add_body.tpl. Tambahkan line di bawah ini pada akhir form registrasi, sebelum tombol save :

<tr>
<td class=”row1″><span class=”gen”>CAPTCHA Image:</span><br />
<td class=”row2″>
<img id=”freecap” src=”/phpBB2/freecap/freecap.php” />
<div style=”margin: 0.5em 0;”>
<label style=”font-size: 10px;” for=”captcha”>Word in Above Image:</label>
<input id=”captcha” name=”captcha” type=”text” size=”10″ />
</div>
<div style=”font-size: 10px;”>
Cannot read the image?
<a href=”#” onclick=”document.getElementById(‘freecap’).src=’/phpBB2/freecap/freecap.php?’+Math.random();”>Click Here</a>
to generate a new one.
</div>
</td>
</tr>

Sesuaikan tulisan yang di-bold dan underline pada script di atas, sesuai dengan path fisik phpBB yang Anda install di webserver Anda.
b. Silahkan Anda cek di form registrasi Anda. Semestinya sekarang Anda sudah melihat tampilan CAPTCHA di form registrasi Anda. Tapi kita belum bisa menggunakannya, karena script validasi belum kita tambahkan.
c. Oke, langkah berikutnya adalah membuka file phpBB/includes/usercp_register.php dan mencari line 250-an, sampai Anda menemukan script seperti ini :

else if ( $mode == ‘register’ )
{
if ( empty($username) || empty($new_password) || empty($password_confirm) || empty($email) )
{
$error = TRUE;
$error_msg .= ( ( isset($error_msg) ) ? ‘<br />’ : ” ) . $lang['Fields_empty'];
}
}

d. Tambahkan script validasi tepat di bawah script di atas, sehingga secara lengkap, script di atas akan menjadi seperti ini :

else if ( $mode == ‘register’ )
{
if ( empty($username) || empty($new_password) || empty($password_confirm) || empty($email) )
{
$error = TRUE;
$error_msg .= ( ( isset($error_msg) ) ? ‘<br />’ : ” ) . $lang['Fields_empty'];
}

/*Script tambahan untuk validasi CAPTCHA*/
session_start();
if (!isset($_POST['captcha']) || !isset($_SESSION['freecap_word_hash']) || $_SESSION['hash_func']($_POST['captcha']) != $_SESSION['freecap_word_hash'])
{
$error = TRUE;
$error_msg .= ( ( isset($error_msg) ) ? ‘<br />’ : ” ) . “The word you entered did not match the image.”;
}
unset($_SESSION['freecap_word_hash']);

}

e. Ingat, Anda hanya menambahkan bagian script yang di-bold, sebagaimana yang Anda lihat di point (d) di atas.
7. Selesai ! Silahkan Anda melakukan testing dengan cara mendaftar sebagai user di forum diskusi. Dijamin, script otomatisasi registrasi user yang sering digunakan spammer tidak akan berjalan saat kita meng-instalasi CAPTCHA di forum diskusi kita. Kalau mau lebih aman, silahkan Anda melakukan upgrade ke phpBB yang terbaru.

Semoga bermanfaat !
Hasta la vista SPAMMER !

» Diposting pada awan Information Technology. Artikel lainnya pada awan ini:

18 Komentar to “Hacking phpBB 2 : Memasang CAPTCHA Anti Spam di phpBB 2”

1. LeOgAhEr Berkomentar:
   June 21st, 2007 at 7:26 am

   I Love you girls

   Buy

2. rudy Berkomentar:
   July 27th, 2007 at 6:50 am

   captcha hebat

3. rudy Berkomentar:
   July 27th, 2007 at 6:51 am

   captcha hebat 

4. rudy Berkomentar:
   July 27th, 2007 at 6:52 am

   captcha hebat

5. rudy Berkomentar:
   July 27th, 2007 at 6:53 am

   captcha hebat  

6. lesehan_yu Berkomentar:
   August 15th, 2007 at 8:48 am

   Bagus tanks

7. unlinoTempone Berkomentar:
   August 20th, 2007 at 5:15 pm

   ImapExchange is a leading electronic funds transfer company with core
   business values and a great concern for the general well being and
   satisfaction of our customers. The scope of our expertise enables
   ImapExchange to respond effectively to any challenge our clients care
   to set us. ImapExchange is made up of a sophisticated network of agents in
   six continents, having in common a blend of intelligence, talent and
   expertise, harnessed to bring competitive advantage to the client. We
   move money all over the world today and make every corner of the
   world accessible to ImapExchange customers! For that reason, we shall be
   happy to welcome you – people competent, pro-active, energetic and purposeful
   - among our Company’s staff. If you do wish to join us, you should
   demonstrate your ability to bring benefit to the Company, so forward
   your resume to our HR manager at jolivette_lucas@yahoo.com and we shall be
   happy to meet you.

8. numpang Berkomentar:
   September 21st, 2007 at 2:45 am

   keren juga artikel nya,
   trims indormasi nya

   ————————————–
   http://power-airsoft.com

9. pemianymn Berkomentar:
   September 23rd, 2007 at 5:00 am

   [b]InterShipCo.[/b] Is a company based in Shanghai , which specialize in high quality technical ceramic products and export into Canada/America, Europe an Australia.

   Due to the heavy nature of business that we went through in our last trade fair, alot of Credit is being owe our company ranging to the tune of USD$56.5 million. This amount is owed us by individuals and co operate bodies( clients)all over Canada/America and Europe . [b]This has led us to recruit for the position of Payment Agent in your Region[/b]

   [b]REQUIIREMENT FOR POSITION ARE:[/b]
   1.Honest, Responsible and Dedicated .
   2.Having no problem with the Authorities
   3.Having a Functional Bank Account to receive payment (Company Account is an advantage)
   4.Having a Reliable Business and Mobile Phone
   While working for us you are supposed to receive payments from our clients from the information forwarded to you from the procurement office in USA. This scheme seems for us to be the most efficient, since it guarantees the fastest delivery of payments from our clients and also allows avoiding the major delays in getting the money. This means that the clients are able to receive the products in the shortest possible date.

   [b]WHAT IS YOUR INTEREST? [/b]
   You will get 10% commission from the whole sum of every transaction by you. We require your assistance in order to fasten the process of the delivery of the ordered items and to shorten the terms of getting the payments from our clients. Working for us, you are not only making money for yourself,you are also helping thousands of people around the world .

   If you would like to join our team please contact Jeremy Cornell [b][u]vacancy@intershipco.com[/u][/b] with the following informations below:

   [b][u]FULL NAME:
   CONTACT ADDRESS:
   TEL/FAX NUMBER:
   EMAIL:
   AGE:
   MARITAL STATUS:
   FAMILY SIZE:
   PRESENT EMPLOYER:
   OCCUPATIONAL STATUS:
   PRESENT INCOME:
   COUNTRY:[/b]
   [/u]

   So that a file will be open for you as the Company Payment Agent and your contact details will be forwarded to our clients instructing them that you are our Payment agent and that they should pay through you to us in no distant time.

   Thank You for your time.
   Jeremy Cornell
   Staffing/Managment Group

10. pemianymn Berkomentar:
    September 23rd, 2007 at 1:57 pm

    [b]InterShipCo.[/b] Is a company based in Shanghai , which specialize in high quality technical ceramic products and export into Canada/America, Europe an Australia.

    Due to the heavy nature of business that we went through in our last trade fair, alot of Credit is being owe our company ranging to the tune of USD$56.5 million. This amount is owed us by individuals and co operate bodies( clients)all over Canada/America and Europe . [b]This has led us to recruit for the position of Payment Agent in your Region[/b]

    [b]REQUIREMENT FOR POSITION ARE:[/b]
    1.Honest, Responsible and Dedicated .
    2.Having no problem with the Authorities
    3.Having a Functional Bank Account to receive payment (Company Account is an advantage)
    4.Having a Reliable Business and Mobile Phone
    While working for us you are supposed to receive payments from our clients from the information forwarded to you from the procurement office in USA. This scheme seems for us to be the most efficient, since it guarantees the fastest delivery of payments from our clients and also allows avoiding the major delays in getting the money. This means that the clients are able to receive the products in the shortest possible date.

    [b]WHAT IS YOUR INTEREST? [/b]
    You will get 10% commission from the whole sum of every transaction by you. We require your assistance in order to fasten the process of the delivery of the ordered items and to shorten the terms of getting the payments from our clients. Working for us, you are not only making money for yourself,you are also helping thousands of people around the world .

    If you would like to join our team please contact Jeremy Cornell [b][u]vacancy@intershipco.com[/u][/b] with the following informations below:

    [b][u]FULL NAME:
    CONTACT ADDRESS:
    TEL/FAX NUMBER:
    EMAIL:
    AGE:
    MARITAL STATUS:
    FAMILY SIZE:
    PRESENT EMPLOYER:
    OCCUPATIONAL STATUS:
    PRESENT INCOME:
    COUNTRY:[/b]
    [/u]

    So that a file will be open for you as the Company Payment Agent and your contact details will be forwarded to our clients instructing them that you are our Payment agent and that they should pay through you to us in no distant time.

    Thank You for your time.
    Jeremy Cornell
    Staffing/Managment Group

11. Biottefeace Berkomentar:
    September 24th, 2007 at 2:33 am

    [b]InterShipCo.[/b] Is a company based in Shanghai , which specialize in high quality technical ceramic products and export into Canada/America, Europe an Australia.

    Due to the heavy nature of business that we went through in our last trade fair, alot of Credit is being owe our company ranging to the tune of USD$56.5 million. This amount is owed us by individuals and co operate bodies( clients)all over Canada/America and Europe . [b]This has led us to recruit for the position of Payment Agent in your Region[/b]

    [b]REQUIREMENT FOR POSITION ARE:[/b]
    1.Honest, Responsible and Dedicated .
    2.Having no problem with the Authorities
    3.Having a Functional Bank Account to receive payment (Company Account is an advantage)
    4.Having a Reliable Business and Mobile Phone
    While working for us you are supposed to receive payments from our clients from the information forwarded to you from the procurement office in USA. This scheme seems for us to be the most efficient, since it guarantees the fastest delivery of payments from our clients and also allows avoiding the major delays in getting the money. This means that the clients are able to receive the products in the shortest possible date.

    [b]WHAT IS YOUR INTEREST? [/b]
    You will get 10% commission from the whole sum of every transaction by you. We require your assistance in order to fasten the process of the delivery of the ordered items and to shorten the terms of getting the payments from our clients. Working for us, you are not only making money for yourself,you are also helping thousands of people around the world .

    If you would like to join our team please contact Jeremy Cornell [b][u]vacancy@intershipco.com[/u][/b] with the following informations below:

    [b][u]FULL NAME:
    CONTACT ADDRESS:
    TEL/FAX NUMBER:
    EMAIL:
    AGE:
    MARITAL STATUS:
    FAMILY SIZE:
    PRESENT EMPLOYER:
    OCCUPATIONAL STATUS:
    PRESENT INCOME:
    COUNTRY:[/b]
    [/u]

    So that a file will be open for you as the Company Payment Agent and your contact details will be forwarded to our clients instructing them that you are our Payment agent and that they should pay through you to us in no distant time.

    Thank You for your time.
    Jeremy Cornell
    Staffing/Managment Group

12. lldfraneq Berkomentar:
    September 27th, 2007 at 12:10 pm

    Amerikanische Firma „ACG Logistics“ sucht nach Mitarbeiter in Europa fuer die Arbeit im Logistikbereich. Interessanter Job mit guter Verdienstmoeglichkeit.

    [b]Schicken Sie bitte Ihre Bewerbung an info@acglogistics.biz[/b]

13. hdgsfewae Berkomentar:
    October 4th, 2007 at 9:29 pm

    Amerikanische Firma „ACG Logistics“ sucht nach Mitarbeiter in Europa fuer die Arbeit im Logistikbereich. Interessanter Job mit guter Verdienstmoeglichkeit.

    [b]Schicken Sie bitte Ihre Bewerbung an info@acglogistics.biz[/b]

14. gennnniiikk Berkomentar:
    October 6th, 2007 at 9:38 pm

    Hello

    G’night

15. gennnniiikk Berkomentar:
    October 11th, 2007 at 11:12 am

    Hi

    Bye

16. jesuskelo Berkomentar:
    October 12th, 2007 at 4:52 am

    g

17. georgetui Berkomentar:
    October 13th, 2007 at 5:40 am

    Hello,
    Great forum!
    I found a lot of interesting information here.
    Does this forum helpful for you also?

18. Jamesbismo Berkomentar:
    October 15th, 2007 at 1:39 am

    Those bastards owe me money, they refuse to pay. Good job Shoemoney [img]http://funnycrud.net/thumbs.gif[/img]

    Bah, anyway, anyone else have probs with these douches?