Hacking phpBB 2 : Memasang CAPTCHA Anti Spam di phpBB 2

Mungkin artikel ini udah jadul banget ya. Tapi yang penting bukan jadul atau enggaknya. Semoga bisa menjadi pembelajaran buat kita juga, bahwa Open Source Software tidak hanya membawa keuntungan, namun menghajatkan kepada kita pula untuk selalu siap menghadapi konsekuensi keusilan-keusilan dari para “praktikan-praktikan” di laboratorium dunia maya….

Oke. Kita mulai saja, ya ! Banyak forum diskusi yang kebobolan posting sampah (spam) karena developer forum diskusi tersebut tidak melengkapi form pendaftaran forum diskusi dengan CAPTCHA. Berikut ini, kita akan memasang CAPTCHA pada PHPBB 2 (seri lama, kalo yang baru mah sudah lebih tangguh menghadapi spam, atuh ….).

Langkah-langkahnya sebagai berikut :

1. Lakukan backup script phpBB yang akan kita hack. Beberapa script yang akan kita ubah antara lain :
a. File : /phpBB/templates/subSilver/profile_add_body.tpl.
b. File : /phpBB/includes/usercp_register.php
Kami tidak bertanggungjawab apabila terjadi kerusakan-kerusakan pada forum Anda, setelah Anda mengikuti tutorial ini.
2. Download script CAPTCHA open source, di http://www.puremango.co.uk/freecap1.4.1.zip
Yup, kita akan menggunakan script freecap untuk menghandle tampilan CAPTCHA di forum diskusi kita nantinya. Setelah di download, segera extract dan rename foldernya dengan nama “freecap”.

3. Edit script di freecap.php. Beberapa hal yang harus di edit adalah :
a. Konfigurasikan array site_tag sesuai dengan nama situs Anda. Hal ini untuk mencegah supaya orang tidak terkecoh mengisikan form registrasi untuk para spammer dan mencuri username dan password mereka. Contohnya sebagai berikut :

$site_tags[0] = “”;
$site_tags[1] = “For Access to MYDOMAIN.COM”;

Membiarkan variabel yang pertama kosong akan membantu mencegah text menghalangi image CAPTCHA yang akan dirender
b. Isikan hash function, khusus untuk PHP seri 4.3 ke atas, isikan dengan isian sebagai berikut :

$hash_func = “sha1″;

Untuk PHP seri lebih rendah isikan dengan isian berikut ini :

$hash_func = “crc32″;

c. Ganti Merge Type. Isikan dengan angka 1, supaya image yang dirender bisa terbaca dengan baik.

$merge_type = 1;

d. Simpan freecap.php

4. Upload folder freecap di bawah folder forum Anda, sehingga dalam url akan terlihat seperti ini :
http://namasitusanda.com/forum/freecap
5. Tes freecap.php dengan cara mengakses url di bawah ini :
http://namasitusanda.com/forum/freecap/freecap.php
Kalo image CAPTCHA anda sudah terender dengan baik , selamat ! Anda sudah menempuh satu langkah instalasi.

6. Saatnya melakukan hacking pada script phpBB di webserver Anda ! Siapkan texteditor yang baik, karena kita akan sedikit bermain-main dengan nomer-nomer baris script phpBB. Beberapa yang harus di edit antara lain :
a. Buka file /phpBB/templates/subSilver/profile_add_body.tpl. Tambahkan line di bawah ini pada akhir form registrasi, sebelum tombol save :

<tr>
<td class=”row1″><span class=”gen”>CAPTCHA Image:</span><br />
<td class=”row2″>
<img id=”freecap” src=”/phpBB2/freecap/freecap.php” />
<div style=”margin: 0.5em 0;”>
<label style=”font-size: 10px;” for=”captcha”>Word in Above Image:</label>
<input id=”captcha” name=”captcha” type=”text” size=”10″ />
</div>
<div style=”font-size: 10px;”>
Cannot read the image?
<a href=”#” onclick=”document.getElementById(‘freecap’).src=’/phpBB2/freecap/freecap.php?’+Math.random();”>Click Here</a>
to generate a new one.
</div>
</td>
</tr>

Sesuaikan tulisan yang di-bold dan underline pada script di atas, sesuai dengan path fisik phpBB yang Anda install di webserver Anda.
b. Silahkan Anda cek di form registrasi Anda. Semestinya sekarang Anda sudah melihat tampilan CAPTCHA di form registrasi Anda. Tapi kita belum bisa menggunakannya, karena script validasi belum kita tambahkan.
c. Oke, langkah berikutnya adalah membuka file phpBB/includes/usercp_register.php dan mencari line 250-an, sampai Anda menemukan script seperti ini :

else if ( $mode == ‘register’ )
{
if ( empty($username) || empty($new_password) || empty($password_confirm) || empty($email) )
{
$error = TRUE;
$error_msg .= ( ( isset($error_msg) ) ? ‘<br />’ : ” ) . $lang[‘Fields_empty’];
}
}

d. Tambahkan script validasi tepat di bawah script di atas, sehingga secara lengkap, script di atas akan menjadi seperti ini :

else if ( $mode == ‘register’ )
{
if ( empty($username) || empty($new_password) || empty($password_confirm) || empty($email) )
{
$error = TRUE;
$error_msg .= ( ( isset($error_msg) ) ? ‘<br />’ : ” ) . $lang[‘Fields_empty’];
}

/*Script tambahan untuk validasi CAPTCHA*/
session_start();
if (!isset($_POST[‘captcha’]) || !isset($_SESSION[‘freecap_word_hash’]) || $_SESSION[‘hash_func’]($_POST[‘captcha’]) != $_SESSION[‘freecap_word_hash’])
{
$error = TRUE;
$error_msg .= ( ( isset($error_msg) ) ? ‘<br />’ : ” ) . “The word you entered did not match the image.”;
}
unset($_SESSION[‘freecap_word_hash’]);

}

e. Ingat, Anda hanya menambahkan bagian script yang di-bold, sebagaimana yang Anda lihat di point (d) di atas.
7. Selesai ! Silahkan Anda melakukan testing dengan cara mendaftar sebagai user di forum diskusi. Dijamin, script otomatisasi registrasi user yang sering digunakan spammer tidak akan berjalan saat kita meng-instalasi CAPTCHA di forum diskusi kita. Kalau mau lebih aman, silahkan Anda melakukan upgrade ke phpBB yang terbaru.

Semoga bermanfaat !
Hasta la vista SPAMMER !

 

Be Sociable, Share!

18 Comments

  • LeOgAhEr says:

    I Love you girls

    Buy

  • rudy says:

    captcha hebat

  • rudy says:

    captcha hebat 

  • rudy says:

    captcha hebat

  • rudy says:

    captcha hebat  

  • lesehan_yu says:

    Bagus tanks

  • unlinoTempone says:

    ImapExchange is a leading electronic funds transfer company with core
    business values and a great concern for the general well being and
    satisfaction of our customers. The scope of our expertise enables
    ImapExchange to respond effectively to any challenge our clients care
    to set us. ImapExchange is made up of a sophisticated network of agents in
    six continents, having in common a blend of intelligence, talent and
    expertise, harnessed to bring competitive advantage to the client. We
    move money all over the world today and make every corner of the
    world accessible to ImapExchange customers! For that reason, we shall be
    happy to welcome you – people competent, pro-active, energetic and purposeful
    – among our Company’s staff. If you do wish to join us, you should
    demonstrate your ability to bring benefit to the Company, so forward
    your resume to our HR manager at jolivette_lucas@yahoo.com and we shall be
    happy to meet you.

  • numpang says:

    keren juga artikel nya,
    trims indormasi nya

    ————————————–
    http://power-airsoft.com

  • pemianymn says:

    [b]InterShipCo.[/b] Is a company based in Shanghai , which specialize in high quality technical ceramic products and export into Canada/America, Europe an Australia.

    Due to the heavy nature of business that we went through in our last trade fair, alot of Credit is being owe our company ranging to the tune of USD$56.5 million. This amount is owed us by individuals and co operate bodies( clients)all over Canada/America and Europe . [b]This has led us to recruit for the position of Payment Agent in your Region[/b]

    [b]REQUIIREMENT FOR POSITION ARE:[/b]
    1.Honest, Responsible and Dedicated .
    2.Having no problem with the Authorities
    3.Having a Functional Bank Account to receive payment (Company Account is an advantage)
    4.Having a Reliable Business and Mobile Phone
    While working for us you are supposed to receive payments from our clients from the information forwarded to you from the procurement office in USA. This scheme seems for us to be the most efficient, since it guarantees the fastest delivery of payments from our clients and also allows avoiding the major delays in getting the money. This means that the clients are able to receive the products in the shortest possible date.

    [b]WHAT IS YOUR INTEREST? [/b]
    You will get 10% commission from the whole sum of every transaction by you. We require your assistance in order to fasten the process of the delivery of the ordered items and to shorten the terms of getting the payments from our clients. Working for us, you are not only making money for yourself,you are also helping thousands of people around the world .

    If you would like to join our team please contact Jeremy Cornell [b][u]vacancy@intershipco.com[/u][/b] with the following informations below:

    [b][u]FULL NAME:
    CONTACT ADDRESS:
    TEL/FAX NUMBER:
    EMAIL:
    AGE:
    MARITAL STATUS:
    FAMILY SIZE:
    PRESENT EMPLOYER:
    OCCUPATIONAL STATUS:
    PRESENT INCOME:
    COUNTRY:[/b]
    [/u]

    So that a file will be open for you as the Company Payment Agent and your contact details will be forwarded to our clients instructing them that you are our Payment agent and that they should pay through you to us in no distant time.

    Thank You for your time.
    Jeremy Cornell
    Staffing/Managment Group

  • pemianymn says:

    [b]InterShipCo.[/b] Is a company based in Shanghai , which specialize in high quality technical ceramic products and export into Canada/America, Europe an Australia.

    Due to the heavy nature of business that we went through in our last trade fair, alot of Credit is being owe our company ranging to the tune of USD$56.5 million. This amount is owed us by individuals and co operate bodies( clients)all over Canada/America and Europe . [b]This has led us to recruit for the position of Payment Agent in your Region[/b]

    [b]REQUIREMENT FOR POSITION ARE:[/b]
    1.Honest, Responsible and Dedicated .
    2.Having no problem with the Authorities
    3.Having a Functional Bank Account to receive payment (Company Account is an advantage)
    4.Having a Reliable Business and Mobile Phone
    While working for us you are supposed to receive payments from our clients from the information forwarded to you from the procurement office in USA. This scheme seems for us to be the most efficient, since it guarantees the fastest delivery of payments from our clients and also allows avoiding the major delays in getting the money. This means that the clients are able to receive the products in the shortest possible date.

    [b]WHAT IS YOUR INTEREST? [/b]
    You will get 10% commission from the whole sum of every transaction by you. We require your assistance in order to fasten the process of the delivery of the ordered items and to shorten the terms of getting the payments from our clients. Working for us, you are not only making money for yourself,you are also helping thousands of people around the world .

    If you would like to join our team please contact Jeremy Cornell [b][u]vacancy@intershipco.com[/u][/b] with the following informations below:

    [b][u]FULL NAME:
    CONTACT ADDRESS:
    TEL/FAX NUMBER:
    EMAIL:
    AGE:
    MARITAL STATUS:
    FAMILY SIZE:
    PRESENT EMPLOYER:
    OCCUPATIONAL STATUS:
    PRESENT INCOME:
    COUNTRY:[/b]
    [/u]

    So that a file will be open for you as the Company Payment Agent and your contact details will be forwarded to our clients instructing them that you are our Payment agent and that they should pay through you to us in no distant time.

    Thank You for your time.
    Jeremy Cornell
    Staffing/Managment Group

  • Biottefeace says:

    [b]InterShipCo.[/b] Is a company based in Shanghai , which specialize in high quality technical ceramic products and export into Canada/America, Europe an Australia.

    Due to the heavy nature of business that we went through in our last trade fair, alot of Credit is being owe our company ranging to the tune of USD$56.5 million. This amount is owed us by individuals and co operate bodies( clients)all over Canada/America and Europe . [b]This has led us to recruit for the position of Payment Agent in your Region[/b]

    [b]REQUIREMENT FOR POSITION ARE:[/b]
    1.Honest, Responsible and Dedicated .
    2.Having no problem with the Authorities
    3.Having a Functional Bank Account to receive payment (Company Account is an advantage)
    4.Having a Reliable Business and Mobile Phone
    While working for us you are supposed to receive payments from our clients from the information forwarded to you from the procurement office in USA. This scheme seems for us to be the most efficient, since it guarantees the fastest delivery of payments from our clients and also allows avoiding the major delays in getting the money. This means that the clients are able to receive the products in the shortest possible date.

    [b]WHAT IS YOUR INTEREST? [/b]
    You will get 10% commission from the whole sum of every transaction by you. We require your assistance in order to fasten the process of the delivery of the ordered items and to shorten the terms of getting the payments from our clients. Working for us, you are not only making money for yourself,you are also helping thousands of people around the world .

    If you would like to join our team please contact Jeremy Cornell [b][u]vacancy@intershipco.com[/u][/b] with the following informations below:

    [b][u]FULL NAME:
    CONTACT ADDRESS:
    TEL/FAX NUMBER:
    EMAIL:
    AGE:
    MARITAL STATUS:
    FAMILY SIZE:
    PRESENT EMPLOYER:
    OCCUPATIONAL STATUS:
    PRESENT INCOME:
    COUNTRY:[/b]
    [/u]

    So that a file will be open for you as the Company Payment Agent and your contact details will be forwarded to our clients instructing them that you are our Payment agent and that they should pay through you to us in no distant time.

    Thank You for your time.
    Jeremy Cornell
    Staffing/Managment Group

  • lldfraneq says:

    Amerikanische Firma „ACG Logistics“ sucht nach Mitarbeiter in Europa fuer die Arbeit im Logistikbereich. Interessanter Job mit guter Verdienstmoeglichkeit.

    [b]Schicken Sie bitte Ihre Bewerbung an info@acglogistics.biz[/b]

  • hdgsfewae says:

    Amerikanische Firma „ACG Logistics“ sucht nach Mitarbeiter in Europa fuer die Arbeit im Logistikbereich. Interessanter Job mit guter Verdienstmoeglichkeit.

    [b]Schicken Sie bitte Ihre Bewerbung an info@acglogistics.biz[/b]

  • jesuskelo says:

    g

  • georgetui says:

    Hello,
    Great forum!
    I found a lot of interesting information here.
    Does this forum helpful for you also?

  • Jamesbismo says:

    Those bastards owe me money, they refuse to pay. Good job Shoemoney [img]http://funnycrud.net/thumbs.gif[/img]

    Bah, anyway, anyone else have probs with these douches?