CAPTCHA is easily bypassed. I've been doing it for years.
http://decaptcher.com is what I use. Just harvest the image, upload to a team of outsourced workers who send the text of the image back. You then submit the text.
Like I said in a previous post, all you really need to do is change file names (i.e. register.php / post.php) and control names.
Bots don't usually work by following links and clicking buttons. POST/GET requests are directly used instead. The only exception to this is if the writer of the bot has no clue what he's doing. The bot can't send a POST/GET request to register.php if you've renamed it to joinup.php, for instance. You'd just have to change all references in the source from register to joinup. A POST or GET request sends or receives data to or from the server.
A POST submits data to the server. A GET requests data from the server.
Here's an example.
What was happening before:
bot sends post request, after connecting to WG:
followed by the headers (connection, referrer, charset, etc)
and finally by the data (which could be, for instance
Code: Select all
id=newuser&password=newpassword&captcha=icantreadthisshit&email=address@domain.extension
An example of a completed POST:
Code: Select all
POST /register.php HTTP/1.1
Host: weedguru.com
Connection: close
Accept: */*
Content-Length: 85
id=newuser&password=newpassword&captcha=icantreadthisshit&email=address@domain.extension
This is what the bot could send to make a new account. Now, if you were to change register.php to something else, they'd just get a 404 error.
it all just tastes pretty much the same.
