3APA3A
16/01/08, 16:35
Dear Jos?e M. Palazon Romero,
This approach is not new, it was demonstrated by ShAnKaR
<shankar_(at)_shankar.name> against Simple Machines Forum 1.1.2 in June,
2007.
See:
http://securityvulns.ru/Rdocument271.html (in Russian)
http://securityvulns.ru/files/capcha.pl (Exploit code)
http://www.securityfocus.com/archive/1/archive/1/471641/100/0/threaded
--Tuesday, January 15, 2008, 9:01:03 AM, you wrote to bugtraq@securityfoc=
us.com:
JeMPR> Hi all,
JeMPR> Some days ago I wrote an advisory which demonstrates how the
Peter's
JeMPR> Math Antispam Spinoff plugin for wordpress
JeMPR> (http://www.theblog.ca/math-anti-spam) can be defeated by its
audio file.
JeMPR> It's hard to summarize, you better read the advisory, but in a
very
JeMPR> small nutshell, the flaw its about not using any kind of
distortion on
JeMPR> the audio clip, which makes it easily identificable by a script.
JeMPR> Here is the link:
JeMPR> http://docs.google.com/View?docid=3Ddf36cd52_19xzmkwqcg
JeMPR> I'm sure you will find the advisory inspirational, as the
approach is
JeMPR> applicable to many other capthas, and anti-script methods.
JeMPR> Regards
JeMPR> Jose
=20
--=20
~/ZARAZA http://securityvulns.com/
=D7=E5=EB=EE=E2=E5=EA =FD=F2=EE =F2=E0=E9=ED=E0... =FF =E7=E0=ED=E8=EC=E0=
=FE=F1=FC =FD=F2=EE=E9 =F2=E0=E9=ED=EE=E9 =F7=F2=EE=E1=FB =E1=FB=F2=FC =F7=
=E5=EB=EE=E2=E5=EA=EE=EC. (=C4=EE=F1=F2=EE=E5=E2=F1=EA=E8=E9)
This approach is not new, it was demonstrated by ShAnKaR
<shankar_(at)_shankar.name> against Simple Machines Forum 1.1.2 in June,
2007.
See:
http://securityvulns.ru/Rdocument271.html (in Russian)
http://securityvulns.ru/files/capcha.pl (Exploit code)
http://www.securityfocus.com/archive/1/archive/1/471641/100/0/threaded
--Tuesday, January 15, 2008, 9:01:03 AM, you wrote to bugtraq@securityfoc=
us.com:
JeMPR> Hi all,
JeMPR> Some days ago I wrote an advisory which demonstrates how the
Peter's
JeMPR> Math Antispam Spinoff plugin for wordpress
JeMPR> (http://www.theblog.ca/math-anti-spam) can be defeated by its
audio file.
JeMPR> It's hard to summarize, you better read the advisory, but in a
very
JeMPR> small nutshell, the flaw its about not using any kind of
distortion on
JeMPR> the audio clip, which makes it easily identificable by a script.
JeMPR> Here is the link:
JeMPR> http://docs.google.com/View?docid=3Ddf36cd52_19xzmkwqcg
JeMPR> I'm sure you will find the advisory inspirational, as the
approach is
JeMPR> applicable to many other capthas, and anti-script methods.
JeMPR> Regards
JeMPR> Jose
=20
--=20
~/ZARAZA http://securityvulns.com/
=D7=E5=EB=EE=E2=E5=EA =FD=F2=EE =F2=E0=E9=ED=E0... =FF =E7=E0=ED=E8=EC=E0=
=FE=F1=FC =FD=F2=EE=E9 =F2=E0=E9=ED=EE=E9 =F7=F2=EE=E1=FB =E1=FB=F2=FC =F7=
=E5=EB=EE=E2=E5=EA=EE=EC. (=C4=EE=F1=F2=EE=E5=E2=F1=EA=E8=E9)