antispam email encoder

[n_wattam]

sorry if wrong forum section

after looking around at trying to combat email harvesters and bots etc, leaching email address's from websites, i came across the dec/hex method however while this does make it more harder more clever bots etc could still get your email address's

I decided to make my own little script to make these bots work harder and poss eliminate the problem for my self with out someone having to write a bot just for my script.

by encrypting the email addess in php and then outputing an encrypted version to java i can now do the following.

http://www.design-dev.net/antispam/index.php?youremail=your@email.here

have a look for your selves, and dont forget to check out the source code.

This is just a little time filler for my self. Feedback welcome.


EDIT: to display an email anywhere on my site all i have to now do is use the following php code

<? echo encode_email('your email'); ?>


PS. I only have IE on my works pc, anyone using other browsers could you please comment if the script works or not..

Cheers

[artViper]

It works in firefox too.

[n_wattam]

cool cheers...

[scross]

surely by the use of regular expressions someone could just detect wherever the 'decode_email()' function is in the page and snatch the contents from inside and implement your method to simply decode the text. I'll make a script to demonstrate if you want.

Btw It works in Opera

[madwormer2]

In reply to the person above me, there is absolutely no way for you to completely block the mis-use of emails if there is someone who is going to make a script to do it. (Well, there IS but it wouldn't be human readable, defeating the point entirely.)

This script (at the top) provides a way to combat mis-use by bots and whatnot.

I suppose you could randomise chr_adjust, to add a bit more confusion for a bot (who I'd like to officially call a complete a**hole if they wanna misuse emails ;))

Well, I think its good anyway :P

[scross]

In reply to the person above me, there is absolutely no way for you to completely block the mis-use of emails if there is someone who is going to make a script to do it. (Well, there IS but it wouldn't be human readable, defeating the point entirely.)

This script (at the top) provides a way to combat mis-use by bots and whatnot.

I suppose you could randomise chr_adjust, to add a bit more confusion for a bot (who I'd like to officially call a complete a**hole if they wanna misuse emails ;))

Well, I think its good anyway :P

I see your point. If there's a human making a script to work against your script there's generally not much you can do... :bemused:

Good work anyway :)

[bradgrafelman]

You can also convert each character in the e-mail address into the corresponding HTML entity.

See this (http://www.wbwip.com/wbw/emailencoder.html) page for more information.

[n_wattam]

surely by the use of regular expressions someone could just detect wherever the 'decode_email()' function is in the page and snatch the contents from inside and implement your method to simply decode the text. I'll make a script to demonstrate if you want.

Btw It works in Opera


I suppose you could randomise chr_adjust, to add a bit more confusion for a bot (who I'd like to officially call a complete a**hole if they wanna misuse emails ;))

Well, I think its good anyway :P

yeah this value could be randomised, but also another thing which i thought of was to randomise the function name 'decode_email()', this would be very achievalbe as the php generates both the encoded email but also the javascript, so a randomation of the function names or even all the varibles would make things much harder for anti scripts.

However as mentioned i doubt there is a 100%, but you can sure make there job very hard :). The ideas i have used and suggested would require for someone to make an anti script for mine.

If anyone is interested in trying to do this, it would be interesting to put to a test. :D

[madwormer2]

Could you post the source code for the PHP side of things?

Random name function:

function randomName($length){
$output = '';
while(strlen($output)<$length){
$tmp = rand ( 65, 122);
if($tmp > 96 || $tmp < 91 ){
$output .= chr($tmp);
}
}
return $output;
}


I'm pretty sure that if you did randomName(rand(5,100)); That it'd confuse the hell out of anyone.

[n_wattam]

<!--
Notes:
Jobs to do.
convert encryption to Hex chr set instead of dec, so invalid chrs are not used
-->

<!--
/***********************************************
* Email Encoder v1.00- By Neil Wattam
* Visit http://www.design-dev.net/ for full source code
***********************************************/ -->
<?php
function encode_email($emailaddress) {
for ($n = 0; $n < strlen($emailaddress); $n++) {
$chr_adjust = -1;
$encode_email = $encode_email . chr(ord(substr($emailaddress,$n,1)) + $chr_adjust);
}
return "<script>decode_email('" . $encode_email . "');</script>";
}
?>

<script type="text/javascript">
function decode_email(emailaddress) {
for (i = 0; i <= emailaddress.length; i++) {
chr_adjust = -1;
chr = emailaddress.substring(i,i+1);
ascii = chr.charCodeAt(0);
document.write(String.fromCharCode(ascii - chr_adjust));
}
}
</script>

<? //include ('email_encoder.php'); ?>
<? //echo encode_email('<a href="mailto:info@mail.com">info@mail.com</a>'); ?>


This is the source code for my script as it is, see few things i wasnt to change in it, as the notes say above.

[scross]

yeah this value could be randomised, but also another thing which i thought of was to randomise the function name 'decode_email()', this would be very achievalbe as the php generates both the encoded email but also the javascript, so a randomation of the function names or even all the varibles would make things much harder for anti scripts.

These are good ideas and would be quite simple. To make it even harder you could vary the structure of the script, so regular expressions are harder to form to find it. When you're done and you've checked it for errors (for example you have to make sure that chr_adjust doesn't become too negative otherwise the values passed to chr() could be negative) I would be happy to make a 'counter script' to test it out.

Btw randomizing names makes the job harder but it's still quite easy with regex

[madwormer2]

Fine, counter this:


<?php

/***********************************************
* Email Encoder v1.00- By Neil Wattam
* Visit http://www.design-dev.net/ for full source code
* EDITS BY MEEEEEEE lol!!!!
***********************************************/
function randomName($length){
$output = '';
while(strlen($output)<$length){
$tmp = rand ( 65, 122);
if($tmp > 96 || $tmp < 91 ){
$output .= chr($tmp);
}
}
return $output;
}
$GLOBALS['randomName'] = randomName(rand(5,15));
$GLOBALS['chr'] = rand(-8,5);
function encode_email($emailaddress) {
$encode_email = '';
$test = '';
$chr_adjust = $GLOBALS['chr'];
for ($n = 0; $n < strlen($emailaddress); $n++) {
$encode_email .= dechex(ord(substr($emailaddress,$n,1))+ $chr_adjust) ; // + $chr_adjust
}
return "<script>".$GLOBALS['randomName']."('" .
$encode_email
. "');</script>";
}

?>
<script type="text/javascript">function <?php echo $GLOBALS['randomName']; ?>(emailaddress) { for (i = 0; i <= emailaddress.length; i+=2) { document.write(String.fromCharCode((parseInt((('0x') + emailaddress.substring(i,i+2)),16)) - (<?php echo $GLOBALS['chr']; ?>)));}}</script>
<?php
echo '<br />' .encode_email('test@cheese.com');
?>


Yeh, most of thats not mine BTW, most of it's the thread creators ideas and whatnot, I just put it together.

[scross]

Fine, counter this:

...

Yeh, most of thats not mine BTW, most of it's the thread creators ideas and whatnot, I just put it together.

Done. You can see your script in the middle untouched, I used the output capturing functions to capture the output and then it's all regex from there on...


<?php
ob_start();









/***********************************************
* Email Encoder v1.00- By Neil Wattam
* Visit http://www.design-dev.net/ for full source code
* EDITS BY MEEEEEEE lol!!!!
***********************************************/
function randomName($length){
$output = '';
while(strlen($output)<$length){
$tmp = rand ( 65, 122);
if($tmp > 96 || $tmp < 91 ){
$output .= chr($tmp);
}
}
return $output;
}
$GLOBALS['randomName'] = randomName(rand(5,15));
$GLOBALS['chr'] = rand(-8,5);
function encode_email($emailaddress) {
$encode_email = '';
$test = '';
$chr_adjust = $GLOBALS['chr'];
for ($n = 0; $n < strlen($emailaddress); $n++) {
$encode_email .= dechex(ord(substr($emailaddress,$n,1))+ $chr_adjust) ; // + $chr_adjust
}
return "<script>".$GLOBALS['randomName']."('" .
$encode_email
. "');</script>";
}

?>
<script type="text/javascript">function <?php echo $GLOBALS['randomName']; ?>(emailaddress) { for (i = 0; i <= emailaddress.length; i+=2) { document.write(String.fromCharCode((parseInt((('0x') + emailaddress.substring(i,i+2)),16)) - (<?php echo $GLOBALS['chr']; ?>)));}}</script>
<?php
echo '<br />' .encode_email('test@cheese.com');








//-------------START COUNTER SCRIPT---------------------
$data = ob_get_flush();
echo '<br />';
if(preg_match('!<script>(.+)\(\'(.*)\'\);</script>!', $data, $matches)){
$function = $matches[1];
preg_match('!'.preg_quote('<script type="text/javascript">function '.$function.'(emailaddress) { for (i = 0; i <= emailaddress.length; i+=2) { document.write(String.fromCharCode((parseInt(((\'0x\') + emailaddress.substring(i,i+2)),16)) - (').'(.+?)'. preg_quote(')));}}</script>').'!', $data, $match);
$num = $match[1];
$data = $matches[2];
for($i=0; $i<strlen($data); $i+=2){
echo chr(hexdec($data[$i].$data[$i+1]) - $num);
}
}else{
echo 'None';
}
?>


EDIT: Changed CODE box to PHP box for highlighting

[madwormer2]

Now, how long did that take you? Lol.

[scross]

Now, how long did that take you? Lol.

no more than 5 minutes

[madwormer2]

And did you work backwards from the javascript, or the PHP?

Because if you used the PHP you cheated :P

[scross]

And did you work backwards from the javascript, or the PHP?

Because if you used the PHP you cheated :P

I'm not very good at javascript so yes I used the php to get the encoding mechanism. If you want next time just submit a link to a script so I can only see the javascript.

[madwormer2]

http://jshomepage.co.uk/ascii.php

Give that one a go.

Off to an English exam. Ouch...

[scross]

http://jshomepage.co.uk/ascii.php

Give that one a go.

Off to an English exam. Ouch...

Firstly, hope you did well in your exam :)

Secondly, I'm sorry I kind of forgot about this topic and got all dragged back by work.

Thirdly, I have to say it's much harder when you can't see the php (I liked that comment trick and the mixing up of the variable order) but this should work for most cases:

<?php
$content = file_get_contents('http://madwormer2.free.fr/ascii.php');

$content = str_replace(array("\r", "\n"), '', $content);

if(!preg_match('!'.preg_quote('<script type="text/javascript">function ').'(.+?)'.preg_quote('(emailaddress) {').'(.+?) = (-?[0-9]);(.+?) = (-?[0-9]);(.+?) = (-?[0-9]);(.+?) = (-?[0-9]);'.preg_quote(' for (i = 0; i <= emailaddress.length; i+=2) {').'( \s*/?/?.*\s*)'.preg_quote('document.write(String.fromCharCode((parseInt(((\'0x\') + emailaddress.substring(i,i+2)),16)) - (').'(-?[0-9]) (\+|-) (.+?) (\+|-) (.+?) (\+|-) (.+?) (\+|-) (.+?)'.preg_quote(')));}}</script>').'!', $content, $matches)){
echo 'Error: <br />'.$content;
exit;
}

//print_r($matches); exit;
$function = $matches[1];
unset($matches[10]);
$matches = array_values($matches);
$calc = array(0,0,0,0,0,0);
$calc[0] = $matches[11];
$calc[2] = $matches[13];
$calc[4] = $matches[15];
$calc[6] = $matches[17];
for($i=0; $i<4; $i++){
$num = (2 * $i) + 2;
$name = $matches[$num];
$value = $matches[$num+1];
if($name == $matches[12]){
$n = 1;
}else if($name == $matches[14]){
$n = 3;
}else if($name == $matches[16]){
$n = 5;
}else{
$n = 7;
}
$calc[$n] = '('.$value.')';
}
$calc = ' return ('.$matches[10].') '.implode(' ', $calc).'; ';
$num = eval($calc);

preg_match('!<script>'.$function.'\(\'(.+?)\'\);</script>!', $content, $match);
$data = $match[1];
echo $content.'<br /><br /><br />';
for($i=0; $i<strlen($data); $i+=2){
echo chr(hexdec($data[$i].$data[$i+1]) - $num);
}
?>

Basically it's breakable but I think it'd be easier to let a human do it :D

Soon I'll post some code that's even harder to break but I don't have enough time to do all this again :p

Btw sorry for the rubbish code, I was trying to do this quickly

[madwormer2]

Good job on that one, did better than I could have done, I'd have fallen at the parseInt hurdle, I have no idea how that thing works...

And if you have someone willing to go to that length to get emails from your website, you sure do have some enemies!

If you REALLY want proper code, research ciphers, there are some REALLY tough ones out there (I've taken part in the http://www.cipher.maths.soton.ac.uk/ cipher challenge a few years ago, and I got to the penultimate hurdle, and it just got impossible. At least I got a badge and a CD :P)

And the exam wasn't as bad as it could have been.

[scross]

Good job on that one, did better than I could have done, I'd have fallen at the parseInt hurdle, I have no idea how that thing works...

And if you have someone willing to go to that length to get emails from your website, you sure do have some enemies!

If you REALLY want proper code, research ciphers, there are some REALLY tough ones out there (I've taken part in the http://www.cipher.maths.soton.ac.uk/ cipher challenge a few years ago, and I got to the penultimate hurdle, and it just got impossible. At least I got a badge and a CD :P)

And the exam wasn't as bad as it could have been.

Thanks. You're right, they would need to have serious motive to put that much effort in. I was thinking that you can always break that script because the decoding machine (the javascript) is always given to you so all you need to do is figure out it's structure in regex and then decode the text.

A more secure system could create an id (a random string between 40-60 characters) on each request of a page with an email address on it and the id would be stored with a time. There would then be javascript on the page that would take the id and call another php page using ajax. There would be a 10 second time limit for the ajax to call it and then the id would expire. If the id had not expired the php script would output the email address. The problem is this is slow and it's still not too hard to crack.

[madwormer2]

Or create a load of fake email addresses on your domain, and have them all set to autorespond. That'd really piss them off :P

Hmm, how about a system where there's an email, and instead of displaying the email it says "email hidden". When you click it, a box comes up and you have to varify you're human by typing in a CAPTCHA. Then the email is pulled using javascript. Better than the "do it quickly or die" approach lol.

[scross]

Or create a load of fake email addresses on your domain, and have them all set to autorespond. That'd really piss them off :P

Hmm, how about a system where there's an email, and instead of displaying the email it says "email hidden". When you click it, a box comes up and you have to varify you're human by typing in a CAPTCHA. Then the email is pulled using javascript. Better than the "do it quickly or die" approach lol.

even better...why not display the email address in captcha??

[madwormer2]

Oh yeh... lol. But that's just too easy.

[scross]

Hmm, how about a system where there's an email, and instead of displaying the email it says "email hidden". When you click it, a box comes up and you have to varify you're human by typing in a CAPTCHA. Then the email is pulled using javascript. Better than the "do it quickly or die" approach lol.

Wouldn't this be a bit annoying for users? I guess it could work though.

Oh yeh... lol. But that's just too easy.

What?? :) How can it be too easy?? :D

[n_wattam]

nice to see interest still and the anti scripts, very impressed :)...

Origonaly when i first thought about this idea the only real secure way was to make a Javascript varible = a php varible, actuall pass the data across like $java = $php, and without the page having to be submited.

The only way i found was to look at ajax however that went over my head and not to sure if you need additional software installed on the server your hosting on etc.


EDIT
But as said i think the above examples would work nice on your own sites / projects as someone will have to really go out of there way if they want to harvest your sites.

[n_wattam]

in regards to CAPTCHA, what about this idea

instead of an email link you just have a standard link "email me" etc, when this link is clicked a popup box apears, requesting a 3 didgit number using CAPTCHA. when entered the script in the popup then confirm and displays your email or opens your email application.

However again this might be a bit annoying for the browser, then again it will only effect a user if they want to actually send you an email and if they really want to do that entering a few numbers is no real effort...

[scross]

in regards to CAPTCHA, what about this idea

instead of an email link you just have a standard link "email me" etc, when this link is clicked a popup box apears, requesting a 3 didgit number using CAPTCHA. when entered the script in the popup then confirm and displays your email or opens your email application.

However again this might be a bit annoying for the browser, then again it will only effect a user if they want to actually send you an email and if they really want to do that entering a few numbers is no real effort...

it's a good idea, but the pop up might be blocked, even on a link :bemused:
I think a simple non javascript captcha method might be better

[laserlight]

I think that realistically, simple steganography works. If you describe the parts of your email address in a short paragraph, with minimal telltale signs/symbols, then it becomes impractical to try and harvest your email addresses with bots.

The problem comes when you say, have a forum script, and you want the option of listing your users' email addresses. If your email paragraph is in a fixed template, and your script becomes (really) popular, then it becomes trivial for bots to specially look out for it. In such a case the CAPTCHA idea becomes more viable, especially since it can be used to restrict registration and login (or even general use, as I have seen in some online games).

[scross]

Here are some alternatives to captcha: http://www.w3.org/TR/turingtest/

[scross]

I think that realistically, simple steganography works. If you describe the parts of your email address in a short paragraph, with minimal telltale signs/symbols, then it becomes impractical to try and harvest your email addresses with bots.

The problem comes when you say, have a forum script, and you want the option of listing your users' email addresses. If your email paragraph is in a fixed template, and your script becomes (really) popular, then it becomes trivial for bots to specially look out for it. In such a case the CAPTCHA idea becomes more viable, especially since it can be used to restrict registration and login (or even general use, as I have seen in some online games).

perhaps you could mix captcha and steganography