Another Anti-Spam Robot Mod? - Snitz™ Forums 2000

The Forum has been Updated

The code has been upgraded to the latest .NET core version. Please check instructions in the Community Announcements about migrating your account.

Another Anti-Spam Robot Mod? - Postet den 09 Dec 2006 (2413 Views)

janaf

Starting Member

Innlegg: 19

I would guess the spam robots use the form field names when they post/register on forums and send mail spam, so why not change form field names to something unknown?
Here is my approach with an example of replacing the form field name for email.
1) In the config file:

Code:

Dim strEmailField
'## Assign some whatever value / field name
strEmailField = "xxsxy2hsw35"

2) In register.asp replace all

Code:

Request.Form("email")

with

Code:

Request.Form(strEmailField)

3) In inc_profile.asp replace

Code:

name=""email""

with

Code:

name=""" & strEmailField & """

Finished!
Now the spanning software needs to know it should post the email address as a form field value named xxsxy2hsw35.......
The above could of course be done with any/all form field name.
A more advanced version could be to randomly generate the form field names and store them as session variables. Then the form field names would be different each session.
'## if the random generated field names don't excist then create them

Code:


if len(session(strCookieURL & "EmailField")) > 0 then
' do nothing
else
randomize()
	strEmailField = ""
	for i = 1 to 8
	      strEmailField = strEmailField & chr(Int(25 * Rnd)+97)
	next
	session(strCookieURL & "Emailfield") = strEmailField
end if

and then substitute in register.asp and inc_profile.asp for

Code:

session(strCookieURL & "Emailfield")

The same method could be used to prevent automated posting and mailing.

What do you think?<

Sist redigert av

Postet den 09 Dec 2006

Etymon

Advanced Member

Innlegg: 2396

2396

Very interesting! Thank you for sharing this, janaf.

Postet den 10 Dec 2006

janaf

Starting Member

Innlegg: 19

The nice side of this approach is that every field can have a bit of a GateKeeper effect.

I installed the simple version of my mod together with the GateKeeper mod (I did not test the "session variable" version yet). For two days I did not get a single garbage signup

. The last months there has otherwise been about 10 per day.
To prevent automated form postings, I think you want the form pages to be 'unpredictable' by machine, i.e form field names, table sizes and instruction texts should be easily changed. Humans are very good at adapting to some changes, while for programs, it gets much more complicated if input is not well structured.

With a multi language Snitz Forum coming? it may be simple to modify the text instructions to the form fields, so they are not always the same.

I am myself a Snitz Forum programming newbie so I can not do these changes, but if someone else wants to to, please do! You can email me for mor ideas if you like. I guess the spam software developers also monitor this site, so in order to stay a little ahead, I would not like to post more details here until a proper mod/release has been made.<

Postet den 10 Dec 2006

HuwR

Forum Admin

Innlegg: 20611

20611

That is sort of what we have done here as a test on the registration form, except we added a hidden field which has a randomly generated name as well as a randomly generated value.<

Postet den 10 Dec 2006

JJenson

Advanced Member

Innlegg: 2121

2121

Is this something you are thinking about implementing into the next version HuwR?<

Postet den 10 Dec 2006

MarkJH

Senior Member

Innlegg: 1722

1722

I think the random generation way is the only way to go. Anything else added to the next version would be easily incorporated into the spammers various softwares.
If this is successful (which it appears to be - I haven't logged in once and seen any Forum Poster crap on here) then I'd love to see the code that Huw mentioned as a MOD and as future base code.<

Bandlink.net - http://www.bandlink.net/
Bandlink Music Forums - http://www.bandlink.net/forum/