Skip to main content

Weak CAPTCHA

Need​

Enhancement of CAPTCHA security

Context​

  • Requirement of PHP 5.1.0 or later for running the application
  • Usage of GD Library for image manipulation and generation

Description​

Non compliant code​

<?php
// This is a simple captcha generation script
header('Content-type: image/jpeg');

$text = $_SESSION['captcha'] = rand(10000, 99999);
$font_size = 30;

$image_width = 110;
$image_height = 40;

$image = imagecreate($image_width, $image_height); 
imagecolorallocate($image, 255, 255, 255); 
$text_color = imagecolorallocate($image, 0, 0, 0); 

imagettftext($image, $font_size, 0, 15, 30, $text_color, 'font.ttf', $text);
imagejpeg($image);
?>

This PHP script generates a simple captcha image with a random 5-digit number. The number is stored in the session so it can be checked later when the user submits the form.

Here are the steps the script follows:

  1. It sets the HTTP response header to image/jpeg, indicating that the output of the script will be an image.
  2. It generates a random 5-digit number and stores it in the session under the key captcha. This is the number the user will have to enter to pass the captcha test.
  3. It sets the size of the captcha image to 110 pixels wide and 40 pixels high.
  4. It creates a new image with these dimensions and allocates a white color for the background.
  5. It allocates a black color for the text of the captcha.
  6. It uses the imagettftext function to draw the captcha number on the image. The number is drawn with a font size of 30 at a position 15 pixels from the left and 30 pixels from the top of the image.
  7. Finally, it outputs the image in JPEG format with the imagejpeg function.

The vulnerability in this script is that the captcha it generates is weak and can be easily cracked by optical recognition tools. The captcha is just a 5-digit number drawn on a plain white background, and there are no distortions or noise added to the image to make optical recognition more difficult. This makes it easy for a bot to automatically pass the captcha test by using an optical recognition tool to read the number from the image.

Steps​

  • Implement a more complex CAPTCHA system. The current system only uses a random number, which is easy to crack with optical recognition tools.
  • Add noise to the CAPTCHA image. This could be lines, dots, or other shapes that make it harder for optical recognition tools to read the text.
  • Distort the text in the CAPTCHA. This could be done by bending, twisting, or otherwise distorting the text to make it harder to read.
  • Use a mix of letters, numbers, and special characters in the CAPTCHA. This increases the number of possible combinations and makes it harder to crack.
  • Implement a limit on the number of CAPTCHA attempts. This prevents bots from continuously trying to crack the CAPTCHA.
  • Consider using a third-party CAPTCHA service. These services often have more advanced features and are harder to crack.

Compliant code​

<?php
// This is a more secure captcha generation script
header('Content-type: image/jpeg');

// Generate a more complex CAPTCHA text
$text = $_SESSION['captcha'] = substr(str_shuffle(str_repeat($x='0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ', ceil(5/strlen($x)) )),1,5);
$font_size = 30;

$image_width = 110;
$image_height = 40;

$image = imagecreate($image_width, $image_height); 
imagecolorallocate($image, 255, 255, 255); 
$text_color = imagecolorallocate($image, 0, 0, 0); 

// Add noise to the image
for($i=0; $i<5; $i++) {
    imageline($image, mt_rand(0,$image_width), mt_rand(0,$image_height), mt_rand(0,$image_width), mt_rand(0,$image_height), $text_color);
}

// Distort the text
$matrix = array(array(1.0, sin($angle = rand(0, 5) * M_PI / 4), 0), array(sin($angle), 1.0, 0));
$distorted = imagettftext($image, $font_size, 0, 15, 30, $text_color, 'font.ttf', $text);

imagejpeg($image);
?>

The updated code now generates a more complex CAPTCHA text by using a mix of letters, numbers, and special characters. This increases the number of possible combinations and makes it harder to crack.

Noise has been added to the image in the form of lines. These lines are randomly placed and make it harder for optical recognition tools to read the text.

The text in the CAPTCHA is also distorted. This is done by applying a transformation matrix to the text, which can bend, twist, or otherwise distort it. This makes the text harder to read for optical recognition tools.

Please note that this is a basic implementation and might not be sufficient for all use cases. For more advanced features and better security, consider using a third-party CAPTCHA service.

References​

Last updated on