Akismet has protected your site from 235,981 spam comments already.
more drastic antispam measures are now taken
i’ll actually be writing some content along the line and posting on a regular basis ![]()
Download the best open-source site generation engine on the market.
Harnessing the power of Wordpress MU, Pligg, Blogger and Tumblr for hassle-free link building.
Have questions? Need technical support? Apply for our private forum membership. It's easy and it's totally free.
Please start by reading this post where I explain everything about this code, thanks!
This is the code for the Hotmail Image Captcha, and the one for the audio captcha is below the jump ![]()
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 | //This script pulls CAPTCHAs from $urlHotmail and saves them to folder $saveHotmail from the range $startImage to $endImage. $urlHotmail = "http://hipservice.live.com/hipImageDirect.srf?id=68692&config=Hard8Char&tk=1205287476696"; $saveHotmail = "hotmail/"; $startImage = 0; $endImage = 999; //These two lines force the output to be constantly flushed and updated for the user. (ideally) ob_implicit_flush(true); ob_end_flush(); echo "Script Started.\n"; //Pull in the CAPTCHA image as a string with cURL, and save to a file. The curl extension must first be enabled in php.ini. for ($i=$startImage;$i<=$endImage;$i++) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $urlHotmail."&rand=".$i); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $image = curl_exec($ch); curl_close($ch); //Save CAPTCHA to a file with the same name as $i. if(!is_dir($saveHotmail)) mkdir($saveHotmail); $fh = fopen($saveHotmail.$i.".jpg","w"); fwrite($fh,$image); fclose($fh); //Don't allow it to timeout. set_time_limit(40); //Output occasional progress. if ($i%10 == 0) { echo $i." CAPTCHA captured.\n"; flush(); } } echo "Script Complete."; //-maluc |
About this captcha:
length: 8
range: A-Z,2-3,5-6,8-9
case-sensitive: no
background: always gray
text color: always dark blue
overlay: short line paths with 0-3 bends, always dark blue
size: 3200-4400 bytes
width: always 218px
height: alway 48px
other: looks easiest to solve, font size varies
Here is the code for the Hotmail Audio Captcha:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 | //This script pulls CAPTCHAs URL from $urlHotmailAudio with POST parameters $paramsHotmailAudio, then gets the CAPTCHA and saves them to folder $saveHotmailAudio from the range $startSound to $endSound. $urlHotmailAudio = "https://signup.live.com/nexus.fpp?cnmn=Microsoft.Msn.MemberExperience.Nexus.NexusService.GetHipAudioData&ptid=0&a=3ba63739-06f1-491a-9aa3-3f98a343b5d1"; $paramsHotmailAudio = "cn=Microsoft.Msn.MemberExperience.Nexus.NexusService&mn=GetHipAudioData&d=%22en%22,%223ba63739-06f1-491a-9aa3-3f98a343b5d1%22&v=1"; $saveHotmailAudio = "hotmailaudio/"; $startSound = 0; $endSound = 999; //Make carraige returns appear correctly in all browsers. (ideally) echo "<PRE>"; //These two lines force the output to be constantly flushed and updated for the user. (ideally) ob_implicit_flush(true); ob_end_flush(); echo "Script Started.\n"; //Pull in the CAPTCHA image as a string with cURL, and save to a file. The curl extension must first be enabled in php.ini. for ($i=$startSound;$i<=$endSound;$i++) { //First extract a unique URL for each CAPTCHA from the $urlHotmailAudio. $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $urlHotmailAudio."&rand=".$i); curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, $paramsHotmailAudio); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); //If you're having difficulties with SSL, this may need to be enabled. //curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); $result = curl_exec($ch); //Enable this if you're having difficulties. //echo "Error is: ".curl_error($ch); curl_close($ch); //Parse out the URL, and retrieve the CAPTCHA for it. $resultArray = explode('"',$result); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $resultArray[5]."&rand=".$i); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $sound = curl_exec($ch); //Enable this if you're having difficulties. //echo "Error is: ".curl_error($ch); curl_close($ch); //Save CAPTCHA to a file with the same name as $i. if(!is_dir($saveHotmailAudio)) mkdir($saveHotmailAudio); $fh = fopen($saveHotmailAudio.$i.".wav","w"); fwrite($fh,$sound); fclose($fh); //Don't allow it to timeout. set_time_limit(40); //Output occasional progress. if ($i%10 == 0) { echo $i." CAPTCHA captured.\n"; flush(); } } echo "Script Complete."; //-maluc |
And info about the audio captchas as well:
length: 10
range: 0-9
case-sensitive: N/A
background: lower volume gibberish, sounds like numbers really fast with extra noise
size: 46000-131000 bytes
other: numbers seem to follow a steady pace, pitch varies and either a higher pitched woman or low pitched male with robotic senthesizing
Please start by reading this post where I explain everything about this code, thanks!
This is the code for the Google Image Captcha, and the one for the audio captcha is below the jump ![]()
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 | //This script pulls CAPTCHAs URL from $urlGoogle, then gets the CAPTCHA and saves them to folder $saveGoogle from the range $startImage to $endImage. $urlGoogle = "https://www.google.com/accounts/NewAccount?service=mail&continue=http%3A%2F%2Fmail.google.com%2Fmail%2Fe-11-10ba05aeaa8e9b701e5151437f9a44d3-64aeae753cc34f1c864f7edc97a046ccdc96987b&type=2"; $saveGoogle = "google/"; $startImage = 0; $endImage = 999; //These two lines force the output to be constantly flushed and updated for the user. (ideally) ob_implicit_flush(true); ob_end_flush(); echo "Script Started.\n"; //Pull in the CAPTCHA image as a string with cURL, and save to a file. The curl extension must first be enabled in php.ini. for ($i=$startImage;$i<=$endImage;$i++) { //First extract a unique URL for each CAPTCHA from the $urlGoogle. $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $urlGoogle."&rand=".$i); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); //If you're having difficulties with SSL, this may need to be enabled. //curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); $result = curl_exec($ch); //Enable this if you're having difficulties. //echo "Error is: ".curl_error($ch); curl_close($ch); //Parse out the URL, and retrieve the CAPTCHA for it. $result = substr($result,strpos($result,"gaia captchahtml desc")); $resultArray = explode('"',$result); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, rawurldecode($resultArray[2])); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); //If you're having difficulties with SSL, this may need to be enabled. //curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); $image = curl_exec($ch); //Enable this if you're having difficulties. //echo "Error is: ".curl_error($ch); curl_close($ch); //Save CAPTCHA to a file with the same name as $i. if(!is_dir($saveGoogle)) mkdir($saveGoogle); $fh = fopen($saveGoogle.$i.".jpg","w"); fwrite($fh,$image); fclose($fh); //Don't allow it to timeout. set_time_limit(40); //Output occasional progress. if ($i%10 == 0) { echo $i." CAPTCHA captured.\n"; flush(); } } echo "Script Complete."; //-maluc |
About this captcha:
length: 5-8
range: a-z
case-sensitive: no
background: always white
overlay: none
text color: solid blue,green,or red. single color.
size: 2000-3900 bytes
width: always 200px
height: always 70px
other: tilting seemingly random, 5chars is rare, red is rare, shade of solid colors may change between captchas
Here is the code for the Google Audio Captcha:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 | //This script pulls CAPTCHAs URL from $urlGoogleAudio, then gets the CAPTCHA and saves them to folder $saveGoogleAudio from the range $startSound to $endSound. $urlGoogleAudio = "https://www.google.com/accounts/NewAccount?service=mail&continue=http%3A%2F%2Fmail.google.com%2Fmail%2Fe-11-10ba05aeaa8e9b701e5151437f9a44d3-64aeae753cc34f1c864f7edc97a046ccdc96987b&type=2"; $saveGoogleAudio = "googleaudio/"; $startSound = 0; $endSound = 999; //These two lines force the output to be constantly flushed and updated for the user. (ideally) ob_implicit_flush(true); ob_end_flush(); echo "Script Started.\n"; //Pull in the CAPTCHA image as a string with cURL, and save to a file. The curl extension must first be enabled in php.ini. for ($i=$startSound;$i<=$endSound;$i++) { //First extract a unique URL for each CAPTCHA from the $urlGoogleAudio. $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $urlGoogleAudio."&rand=".$i); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); //If you're having difficulties with SSL, this may need to be enabled. //curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); $result = curl_exec($ch); //Enable this if you're having difficulties. //echo "Error is: ".curl_error($ch); curl_close($ch); //Parse out the URL, and retrieve the CAPTCHA for it. $result = substr($result,strpos($result,"wavURL")); $resultArray = explode('"',$result); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, str_replace('\75',"=",$resultArray[1])); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); //If you're having difficulties with SSL, this may need to be enabled. //curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); $sound = curl_exec($ch); //Enable this if you're having difficulties. //echo "Error is: ".curl_error($ch); curl_close($ch); //Save CAPTCHA to a file with the same name as $i. if(!is_dir($saveGoogleAudio)) mkdir($saveGoogleAudio); if(strlen($sound) > 146) { $fh = fopen($saveGoogleAudio.$i.".wav","w"); fwrite($fh,$sound); fclose($fh); } else $i--; //Don't allow it to timeout. set_time_limit(40); //Output occasional progress. if ($i%10 == 0) { echo $i." CAPTCHA captured.\n"; flush(); } } echo "Script Complete."; //-maluc |
And info about the audio captchas as well:
length: not certain (5-10?)
range: 0-9
case-sensitive: N/A
background: equally loud gibberish and noise, really gets in the way.
size: 200044-440044 bytes
other: way too hard for a human – don’t know how blind people do it. pace varies but pitch seems to remain fairly similar.
For those who are interested in security you should definitely check out sla.ckers.org. I’ve read some real gems over there when related to webapp security and it has inspired me before to write some posts. This time, I found something I just had to share with you guys. Don’t worry, I contacted maluc (the original author of the post) to get permission to post his stuff over here.
When it comes to test a captcha and it’s weakness, you always need to have a large sample to work with. If you’re planning to train or write an OCR engine, it’s always useful and sometimes needed to have several samples to play with.
I’m going to start by posting this code to extract a large sample of Yahoo! captchas:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 | <?php //This script pulls CAPTCHAs URL from $urlYahoo, then gets the CAPTCHA and saves them to folder $saveYahoo from the range $startImage to $endImage. $urlYahoo = "https://edit.yahoo.com/reg_json?PartnerName=yahoo_default&RequestVersion=1&ApiName=GetCaptcha&3841320"; $saveYahoo = "yahoo/"; $startImage = 0; $endImage = 999; //These two lines force the output to be constantly flushed and updated for the user. (ideally) ob_implicit_flush(true); ob_end_flush(); echo "Script Started.\n"; //Pull in the CAPTCHA image as a string with cURL, and save to a file. The curl extension must first be enabled in php.ini. for ($i=$startImage;$<=$endImage;$i++) { //First extract a unique URL for each CAPTCHA from the $urlYahoo. $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $urlYahoo."&rand=".$i); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); //If you're having difficulties with SSL, this may need to be enabled. //curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); $result = curl_exec($ch); //Enable this if you're having difficulties. //echo "Error is: ".curl_error($ch); curl_close($ch); //Parse out the URL, and retrieve the CAPTCHA for it. $resultArray = explode('"',$result); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, stripslashes($resultArray[7])); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); //If you're having difficulties with SSL, this may need to be enabled. //curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); $image = curl_exec($ch); //Enable this if you're having difficulties. //echo "Error is: ".curl_error($ch); curl_close($ch); //Save CAPTCHA to a file with the same name as $i. if(!is_dir($saveYahoo)) mkdir($saveYahoo); $fh = fopen($saveYahoo.$i.".jpg","w"); fwrite($fh,$image); fclose($fh); //Don't allow it to timeout. set_time_limit(40); //Output occasional progress. if ($i%10 == 0) { echo $i." CAPTCHA captured.\n"; flush(); } } echo "Script Complete."; //-maluc ?> |
This script will download and save to the /yahoo/ subfolder a sample of 1000 captchas. If you want to get more or less captchas, just edit the $end variable.
He even took some inital anotations for those interested in this particular captcha:
length: 4-6
range: a-z,A-Z,2-8
case-sensitive: no
background: always white
text color: always black
overlay: 1-3 random line paths, always black
size: between 1800 and 3200 bytes
width: always 290px
height: always 80px
other: tilting and bending randomly, 4chars is rare, each letter either 2d sans-serif or 3d serif, some letters not used or in only one case
You can read the original post at sla.ckers.org here. maluc also did the same for the Google and Hotmail captcha’s so be sure to check them out aswell.
Props to maluc one more time ![]()
Found it at http://www.wellingtongrey.net/miscellanea/archive/2008-04-07-what-hath-captcha-wrought.html… While at was working at some captcha breaking stuff ![]()