Re: webform spam

Article View: demon.service

Article #24

#24

From: David Gibson
Date: Sun, 22 Jul 2007 17:47

41 lines
2957 bytes

Answering my own post: In article "webform spam" in <demon.service>, on
Sun, 22 Jul 2007 David Gibson <david@[127.0.0.1]> writes

>However, in your case, I think that it *could* be a 'bot - it wouldnt
>need any very difficult code.  The way to check would be to alter your
>html where it says {INPUT TYPE=SUBMIT} to
>
>{INPUT TYPE=SUBMIT NAME=submit VALUE="Submit Query"}

OK. Having thought about likely 'bot mechanisms for your web form spam,
you could try this...  

** NB: Follow-ups set to demon.homepages.authoring **

1. Set your FORM tag to be 

{FORM ACTION="nojscript.html" METHOD="GET" NAME="myform"
 ONSUBMIT="this.action='/cgi-bin/' + 'mail' + 'form'; 
           document.myform.formtype.value='APS-QUERY';"
}

2. Set the HIDDEN item called formtype to be...

{INPUT TYPE="Hidden" NAME="formtype" VALUE=""}

3. create a page called nojscript.html with appropriate content so that
the form fails gracefully is JavaScript is not running.

As you can see, the effect is that the action=/cgi-bin/mailform and
formtype=APS-QUERY values are not set until the user clicks the submit
button so, with a bit of luck, this makes the form bot-proof.
Additionally, the action URL is not straightforward for a bot to read.

>Might be best to take this to demon.homepages.authoring for further
>discussion.

...which I have now done.

-- 
David Gibson
Spam-cloaked message: The Reply-to: address *is* valid.

Technical Details

Message-ID: <u00t7GBzg5oGFw16@mcrosolv.demon.co.uk>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!border1.nntp.dca.giganews.com!nntp.giganews.com!nx01.iad01.newshosting.com!newshosting.com!newsfeed.icl.net!newsfeed.fjserv.net!newsfeed.esat.net!feeder.news.heanet.ie!feed4.jnfs.ja.net!jnfs.ja.net!qmul!peer-uk.news.demon.net!kibo.news.demon.net!mutlu.news.demon.net!news.demon.co.uk!demon!mcrosolv.demon.co.uk!david

References:

<y0X9JpHN+PoGFwXG@kitzbuhel.demon.co.uk> <EwpOeJD4WRoGFwwg@badminston.demon.co.uk> <OZw0+hoUoSoGFwDl@meden.invalid> <O$1VpuA3ayoGFwBz@mcrosolv.demon.co.uk> <e$RGr4HWW0oGFwij@kitzbuhel.demon.co.uk> <i4yuYvAr21oGFw0k@mcrosolv.demon.co.uk>

Show Full Headers

Complete Article Headers

X-Google-Thread: fad9d,f58d12f4d30cdb2e
X-Google-Thread: f76f2,cc74cfc245b75d5,start
X-Google-Attributes: gidfad9d,gidf76f2,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!border1.nntp.dca.giganews.com!nntp.giganews.com!nx01.iad01.newshosting.com!newshosting.com!newsfeed.icl.net!newsfeed.fjserv.net!newsfeed.esat.net!feeder.news.heanet.ie!feed4.jnfs.ja.net!jnfs.ja.net!qmul!peer-uk.news.demon.net!kibo.news.demon.net!mutlu.news.demon.net!news.demon.co.uk!demon!mcrosolv.demon.co.uk!david
From: David Gibson <david@[127.0.0.1]>
Newsgroups: demon.service,demon.homepages.authoring
Subject: Re: webform spam
Followup-To: demon.homepages.authoring
Date: Sun, 22 Jul 2007 18:47:31 +0100
Organization: Domain name in From address is a black hole.
Lines: 41
Message-ID: <u00t7GBzg5oGFw16@mcrosolv.demon.co.uk>
References: <y0X9JpHN+PoGFwXG@kitzbuhel.demon.co.uk>
 <EwpOeJD4WRoGFwwg@badminston.demon.co.uk> <OZw0+hoUoSoGFwDl@meden.invalid>
 <O$1VpuA3ayoGFwBz@mcrosolv.demon.co.uk>
 <e$RGr4HWW0oGFwij@kitzbuhel.demon.co.uk>
 <i4yuYvAr21oGFw0k@mcrosolv.demon.co.uk>
Reply-To: David Gibson <david-12.spam.delete@mcrosolv.demon.co.uk>
NNTP-Posting-Host: mcrosolv.demon.co.uk
Mime-Version: 1.0
X-Trace: news.demon.co.uk 1185126792 10203 83.104.168.235 (22 Jul 2007 17:53:12 GMT)
X-Complaints-To: abuse@demon.net
NNTP-Posting-Date: Sun, 22 Jul 2007 17:53:12 +0000 (UTC)
X-Newsreader: Turnpike Integrated Version 5.01 U <E9+5V2g0BvDGmce1vsf5$x$rH2>

Reply to Parent Message