大于过滤，小于验证码
我已经建立了一个 PHP 标准联系表单，要求提供姓名、电子邮件和评论。
表单的处理部分会清理数据并确保只输入一封电子邮件等。
不过，我倾向于像这样填写数据...
// ------------- ----- 垃圾开始
名称：PQctQCulKkDyDIWrFsP
电子邮件：[电子邮件受保护]
消息：5DPKep qbkbqmbuhkdf，[url=http://apcxnvhvskdu.com/]apcxnvhvskdu[/url]< /a>, [link=http://ibjvhssfagid.com/]ibjvhssfagid[/link], http://biwgoxskvgib.com/
// ------------ ------ 垃圾结束
我曾经构建过一些东西，它会生成 1-100 之间的随机数，并将其作为隐藏表单传递，然后我有一个用户字段，要求他们向其中添加一个。在接收端我检查了输入的 + 1 = 隐藏的。我仍然会得到这种类型的垃圾，所以要么它不够复杂，不足以阻止自动攻击，要么它是一个人真正在尝试测试。
所以我的问题是......
1）这是验证码可以防止/减少的自动攻击吗？ 2）有人能解释一下有人从中得到了什么吗？没有任何垃圾邮件，链接都是废话，他们无法使用表单发送自己的垃圾邮件......
我不确定这是否只是某种寻找漏洞的钓鱼探险，或者是否有是我缺少的一个更大的目标。
感谢您的任何建议。
I've set up a PHP standard contact form asking for name, email, comments.
The processing part of the form sanitizes the data and makes sure only a single email is entered, etc.
Still, I tend to get data filled out like so...
// ------------------ GARBAGE STARTS
Name: PQctQCulKkDyDIWrFsP
Email: [email protected]
Message: 5DPKep qbkbqmbuhkdf, [url=http://apcxnvhvskdu.com/]apcxnvhvskdu[/url], [link=http://ibjvhssfagid.com/]ibjvhssfagid[/link], http://biwgoxskvgib.com/
// ------------------ GARBAGE ENDS
I built something once that would generate a random number between 1-100 and would pass this as a hidden form, then I had a user field that asked them to add one to it. On the receiving end I checked the entered + 1 = the hidden. I would still get this type of garbage, so either that's not sophisticated enough to thwart automated attacks, or it's a person actually trying to test.
So my questions are...
1) Is this an automated attack that captcha would prevent/reduce?
2) Can someone explain what someone is getting out of this? There's no spam for anything, the links are BS, they're not able to use the form to send their own spam...
I'm not sure if this is just some kind of fishing expedition to look for vulnerabilities, or if there is a bigger purpose I'm missing.
Thanks for any suggestions.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
是的，绝对是。
它可能是一个测试，看看垃圾是否落在公共场所，因此它是实际垃圾邮件发送的可用目标。垃圾邮件发送者也有流量和资源限制，也许这是找到真正“有效”目标的一种方法。
Yes, definitely.
It could be a test to see whether the garbage lands anywhere public, so it's a usable target for actual spamming. Spammers have traffic and resource limitations, too, and maybe that's a way to find targets that actually "work".