[Back to main] [Printable version] [Leave a comment]

Knablart CAPTCHA [Leave a comment]

CAPTCHA picture generator in C++/QT3 and a cookieless, databaseless, AJAX aware checking system in PHP
Copyright (C) 2003-2007 by Jarno Elonen <elonen@iki.fi>

Quickstart

  • install
    • PHP with mcrypt, db4 and CLI support ('php' executable)
    • imagemagick
    • g++
    • QT3 and qmake
  • run ./build-all.sh and wait forever as it generates 5000 images
  • If everything went right, you should now have a captcha.db of about 7MB worth of CAPTCHA images. They should also be in pic-generator/generated/ as separate GIFs
  • Edit config.inc appropriately
    • Check your installation path
    • Change the encryption key. Don't use the default key!
  • Put the whole thing under some web directory and try out usage-example.php.
    • Don't forget to copy .htaccess, too! Otherwise the DB and you encryption key will be world-accessible!

How it works

  • Off-line preparation:
    • Creates a large enough amount of challenge pictures (gifs) with a C++/QT3 program (QT4 probably won't work)
    • Puts them into a DBA (default: db4) file
  • On-line:
    • Creates HTML and Javascript for the challenge with one PHP call (see usage-example.php).
    • Sends an encrypted version of the correct answer and a timestamp along with the form code in a "type=hidden" field.
      • This makes and HTTP session management unnecessary.
      • Points the img tag to a PHP script that decrypts the answer field and fetches the correct image data from the DBA file.
    • If Javascript is enabled, checks user's answer AJAX-style (immediately by a Javascript HTTP request) and displays "OK" or "Wrong" even before the user hits Submit. Failure results in a 2-3 second delay.
    • When checking the answer (on HTTP server side), decrypts the correct answer and fails expired (time configurable) challenges to prevent answer reuse (playback attacks).

Comments on page '/code/knablart-captcha'

Name:
Email (opt):
Message (no HTML support):
Comment type: Public Private (for page author only)
Spam check: + 2 = 8
Email is optional, not visible to other users, and only used for possible replies.
Please note that the comments are not guaranteed to stay on-line. Trivial questions may be removed after answering them. Corrective and additional notes are sometimes integrated into the main article. Thanks and critisicm are welcome, but are pruned away from time to time. Offensive, abusive, distasteful or aggressive messages are of course removed without a second thougt. Messages sometimes disappear for technical reasons and sometimes just because the administrator felt like removing them.