Breaking the phpBB CAPTCHA

This article has been originally published on the old phpBB.cc site on April 10, 2006. As of today, the phpBB 2.0.x visual confirmation remains the same.

The recently released phpBB version 2.0.20 comes with the “Visual Confirmation” enabled by default. Too little, too late. The phpBB CAPTCHA has been successfully broken. Moreover, it is unbearably easy to break. A small desktop application which demonstrates this vulnerability is presented below.

This article is not intended at encouraging spambot development. The described application or the underlying algorithm will not be offered for sale. The author merely hopes to raise the phpBB users’ and developers’ awareness of the need to replace the CAPTCHA with a better one ASAP. He has already been contacted by a member of the phpBB development team after the first draft has been published. The developer refused to identify him/herself, but promised that efforts of solving the problem are being made.

The author provides phpBB customization services. If you want to make your board more secure, you may send him an email.



First, the path to the CAPTCHA image has to be specified. It typically looks like:

http://domain.com/profile.php?mode=confirm&id=$id

Depending on the cookie settings, it may be succeeded by an additional sid parameter.



The phpBB script produces a Portable Network Graphics image. It performs no check whatsoever for repeated requests, so unlimited number of variations may be produced, allowing for elimination of ambiguous OCR results.



The first step of the algorithm eliminates the background noise, leaving distinct character shapes. This step is trivial due to the critically simple noise nature.



The second step allows for cleaner character images by running a 3×3 convolution on the intermideate image matrix.

If performance is critical, this step should be preceded by border detection. The particular order in which the steps are presented in this article has been chosen for better clarity.



In this step, a bounding box for each character is detected.

As it has been noted already, border detection prior to foreground enhancement would be more efficient.



Each of the sub-images extracted in the previous step is compared to well-known font images. A character corresponding to the best match is selected for each.



The algorithm successfully recognizes most characters. One variation may occasionally mistake S for B, another 3 for 8. Combining the two variations, however, eliminates this problem.

As noted previously, unlimited queries with the same id may be made, producing different images for the same string. In addition, two retries are allowed. Repeated queries combined with retries make recognition mistakes negligible.

http://blog.phpbb.cc/articles/captcha

phpBB SEO Dynamic Meta tags

Title : phpBB SEO Dynamic Meta tags
Author : dcz / http://www.phpbb-seo.com/
Description : Generates dynamic metatags for phpBB.
Version : 0.2.0
Installation Level : Eazy.
Installation Time : 5 min.
EZmod : Yes.
phpBB : 2.0.22

This mod will add dynamic meta tags build out with the ending page's content.
It's simple and efficient, will add specific meta tags to categories, forums and the index without adding any SQL Query.
A single SQL query is added in viewtopic.php, to grab the first post's most used words.
Part of this code inspired from ( http://www.phpbb.de/viewtopic.php?t=49679 ) Larsneo and Titus.
You should not use more than 20 keywords in the keyword meta tags
As well, you should not use too long description tags

http://www.phpbb-seo.com/boards/phpbb-seo-toolkit/phpbb-seo-dynamic-meta-tags-vt74.html

phpBB for Dummies

Good topic, about phpBB install

How to set up a basic web server for the purpose of running a message board.
How to set up an SQL database for the purpose of running a message board.
How to install, configure, and administer a phpBB online message board.
phpBB with a Linux Server
phpBB with a Windows Server
phpBB with a Mac OS X Server

http://graynetwork.org/phpBB/

You Can Stop Spam Bots on a phpBB 2.x.x Forum

Is your phpBB forum being overridden by spam-bots? Standart recommendation is "go to their support forums and install modifications or hacks", but they don’t work! It`s simple. All common solutions will not work. If someone public a common solution, the spam bots will adapt to it very soon. Robots have adapted to captacha images, email verification, and other common defenses. Solution is simple, all you have to do is be unique. One simple tip on how you can do that and keep the spam bots at bay.

It is my best guess that the image verifications are the hardest to crack, so in theory, if you tweak that, the bots will not be able to adapt to it.
Make sure you have the latest version of phpBB installed (given)
Enable image verification, and user activation
Open up phpbb/includes/usercp_confirm.php
Find tweakable values. Some examples are $total_width, $total_height, $img_width, $img_height, $width, (you get the idea)
Preview as you tweak to make sure the images are still readable, yet make sure you are making noticeable changes.

I tweaked the $width variable on line 87 to the point where some of the letters were getting squished together and getting cut off by a few pixels, and that was enough for me.

I tried this method on a board that was getting 10-15 spam registrations a day. It’s been spam free for almost a month now.

If you find a method that woks, post it, but generalize it. If you get too many people start copying you exactly, it will make it work the spammer’s time to adapt to it. Remember, the key is to make your board different from all the others.

http://www.pr0gr4mm3r.com/entry/25/How_to_Stop_Spam_on_a_phpBB_2x/

Phpbb forums: A rainbow Of World Languages

You may not know that phpbb forums has a worldwide audience with the potential to reach more than half of the world’s population in their native language. Language packs translators have expanded phpbb to the far corners of our network.

Almost any software program, expanding it beyond one’s native language presents its own special problem.

I am impressed by phpbb as it has expanded the reach of forums well beyond English and Western speaking countries to Europe, Africa, and South America. Indeed, not a continent is not represented save for Antarctida. Then again, if royal penguins knew how to communicate on our level I am sure a program would be made up especially for them!

Here is complete list of 60 different languages:

Albanian; Arabic; Afrikaans; Asturina; Azerbaijani; Basque; Bosnian; Breton; Bulgarian; Catalan; Chinese [simplified and traditional]; Croatian; Czech; Danish; Dutch; Esperanto; Estonian; Finnish; French; Farsi; Galician; German [simplified and formal]; Greek, Hebrew; Hungarian; Icelandic; Indonesian; Italian; Japanese; Korean; Kurdish; Lithuanian; Macedonian; Mongolian; Norwegian [2 dialects]; Polish; Portuguese [2 dialects]; Romanian; Russian [2 dialects]; Sakha; Serbian [2 dialects]; Slovakian; Slovenian; Spanish [2 dialects]; Swedish; Tatarish; Thai; Uighur; Ukrainian; Vietnamese; and Welsh. Yes, and English is also one of the programs!

If you are one who favors international goodwill than you can appreciate as much as To further the software’s reach, phpbb encourages the creation of additional translation packs. A huge knowledge base to help translators out in their quest is listed right online.

As I mentioned elsewhere, phpbb is a free software one that virtually anyone can download and translate into their own language provided they have a computer and internet access. One has to think that this bit of goodwill can go very far.

The correct update of your phpBB2 forum

1. Subscribe to the developers mailing list for notification of any updates. You must do it as no one will tell you your site is out of date although your administration panel will give that information to you.

2. When new version is announced select between several methods: a “changed files only” update or a “patch” update. If you dont have made any extra special modifications and hacks to your forum than the first choice is what you want. Simply download the file to your desktop, unzip it, and follow the installation instructions on how to update your board. If you have added on some modifications than select “patch” update. If you select the former method you will delete all of your modifications. Thus, only a patch update is what you want in order to keep your modifications in place.

That is all. When new version is announced, plan on installing sooner rather than later as many updates include important security improvements that can help to close holes in the program.

You Can Simplify The PhpBB Set Up Process!

I set up my first phpbb2 forum in Juli 2003, I did so under duress. Just days earlier, my then message board host – AvroraBB – had their entire system shut down by hackers. Or so they claimed. My very popular site, snowbording& skiing in Siberia were left in the dark as AvroraBB’s system rendered the sites virtually inoperable. With a repair promised, but several weeks away, I decided that I needed to quickly move away from it and over to a forum where I could exercise full control. Enter phpBB2.

I needed to use a AvroraBB converter file to transfer threads over to the new site, and I had to take the long way of setting up my new forum. Indeed, the converter file was imperfect and quite a number of threads never made the transition. Still, when all was said and done, the new forums were light years ahead of AvroraBB.

Since setting up my first forum, I had to set up a second forum for my customer. This time, I chose the quick route by setting up the forum through my old hoster. As is the practice of some web hosts, fully set up forums are available for your downloading. You can simply select a web host offering this feature, establish your database with them (usually MySQL or PostgreSQL), and download the files. Within minutes, a fully usable forum will be established on your site and all you have to do is set up the forum parameters and then you are ready to change the world.

PhpBB2 is a terrific forum, one that doesn’t charge set up fees or an annual license charge (
unlike vBulletin etc.) and is certain to help you make your site better. Download phpbb2 today to get started on building your online community!

PhpBB2 is a rewarding open source forum, but a difficult and time consuming download if you choose to do it on your own. Fortunately, users now have a way to set up their forum and have it fully functioning in less than 30 minutes. Read on and I will telll you how.

PhpBB 3.0 Beta 5

We are pleased to announce the availability of the phpBB3 Beta5 package. This fifth beta release marks the nearing end of the beta testing phase. The next release we anticipate will be Release Candidate 1.

With this beta a full update path is provided from Beta4 to Beta5, as well as the convertor for converting phpBB 2.0.x installations to phpBB3 Beta5. We decided to give away the proposed convertor package to let it properly test and fix any remaining issues encountered before using this as the primary method of converting, the same way we did with the update package release before. This means that you should test converting your forums and report any bugs or issues you notice, but not depend on a successful conversion - you should still not use this beta in a live environment and you should always be able to completely remove your installation to perform a fresh installation. But conversions will allow you to test this beta on a wider scale as well as doing a test run for those wanting to convert their installations once the release candidate is available.