Using Google reCAPTCHA v2

-
What is a reCAPTCHA? You have seen them online and perhaps have been wondering how they work. I know I have been seeing these for years but didn't really understand them until I saw the process. In this example I don't go into the creation of the system behind reCAPTCHA's, but rather here I am just showing how to use the Google reCAPTCHA v2. I have seen these used ubiquitously all over the internet and I decided to learn what they are and how I can implement them on my own sites to verify that my site's users are indeed people and not bots.

The PHP is pretty standard. I send the API a user's name, Key, response Key and IP address. Then I get the file contents, decode the JSON and verify a user's authenticity.


PHP CODE:



HTML CODE:

The HTML code for this example is just a simple sample text box form for a user's name, this can be for a username, email or even to verify if a survey is being taken by a human rather than by a bot. The uses for this are endless and that is why you can find these all over the internet.



This next part had me stuck for a moment, I had been referencing some old tutorials and now Google has buttoned down their security for this a bit. To get the correct responses the site needs to be served over HTTPS. I quickly added an SSL cert with Let's Encrypt and now it works properly. Here in this screenshot you can see a simple form box where you can enter your name. Once a user clicks the reCAPTCHA and it verifies that they are not a bot the request is accepted and I am just echoing back the user input. For an application or website I would just pipe the output to whatever database or other page rather than the echo which is done here for illustrative purposes below.


I included this to show the flow of reCAPTCHA although most people have probably seen this as they explore the internet.

Upon successful completion of the above little exercise the system authenticates that a user is authentic or not. Here since the reCAPTCHA was completed successfully and I entered my name as 'J', the system tells me it verified that I'm not a bot and that is has captured my name as 'J'. This system is particularly interesting because its initial purpose was to help digitize illegible books and now it's used to verify users as humans. So not only did I learn some cool PHP tricks while learning how to do this, I also learned a little more about internet history.


Comments

Post a Comment

Popular posts from this blog

Automated Exploitation of a Bluetooth vulnerability that leads to 0-click code execution

-
Image
This blog post covers an interesting vulnerability that was just discovered earlier this year and an open source free tool that was created to automate testing for this vulnerability in Bluetooth devices.  I will preface this with the warning that this is of course done in my personal testing lab environment with my own devices for learning and demonstration purposes. I am in no way encouraging that these tools, snippets of code or techniques be used maliciously as there can be very serious legal consequences for those that use these hacking tricks nefariously. However, in a personal testing lab environment I think this is great for learning and allows someone to quickly be able to confirm or deny if their personal devices are truly standing up to the Bluetooth CVE of CVE-2023-45866 . CVE-2023-45866 is described as an issue where the " Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept
Read more

Sniffing GSM traffic on a private cellphone network

-
Image
Legal Disclaimer: GSM Research and Passive Traffic Monitoring ‘The information provided in this blog is for educational and informational purposes only. The author and publisher of this blog are not responsible for any misuse, illegal activities, or damages that may arise from the use of the information provided herein. The author conducted research using two Samsung phones and a BladeRF with YateBTS to create a small-scale GSM network for the purpose of analyzing and intercepting traffic. It is important to note that intercepting or tampering with wireless communication without proper authorization is illegal in many jurisdictions. The author undertook this research within a controlled and lawful environment, and any techniques or findings described in this blog should not be replicated or applied in unauthorized or illegal activities. The author strongly advises against engaging in any illegal activities, including but not limited to intercepting or tampering with wireless communicat
Read more

Raspberry Pi WiFi Honeypot 🍯

-
Image
This was a fun project to work on and build out. I learned a few new interesting tricks along the way. I started with this tutorial from 2013 by Andy Smith . However, a few things have changed with hostapd that I had to figure out through debugging. Also, the configuration of the nginx server as well as dnsmasq were slightly different for me using the new Raspbian Buster for Raspberry Pi 4.  This should save you some time if you follow my trick tips later on in the article that I found by searching through various message boards and googling error messages as I did debugging to get this working properly. I have gone over setting up nginx servers in previous articles so if you need help with getting started these may be helpful. So first things first. I started with a canakit and assembled the raspberry pi with the appropriate heat sinks and a little fan set to a standard speed. The speed is adjusted by how you install the wiring. If you haven't done this before you can follow the
Read more