protecting image filenames for a custom image-click CAPTCHA - c#

I'm teaching myself .NET c# through books and self-assigned projects for fun. I thought it could be a good experience to try and create my own image click captcha control from scratch. The kind where you identify "the right image" from a few options and click the right one (the cat or something) to identify yourself as human.
As I was trying to think of all the ways a script might learn its way around whatever I create, I considered the possibility that it could simply learn the right answers from trial-error and saving the filenames of each image. Eventually it'd learn which filenames were the "right ones"
I can't think of any way to actually hide an image filename from a browser or source code, but renaming them every go-through isn't practical either. Is there some way I could "render" the images in some sort of custom MIME type (is that the right question? i'm new sorry) each time they're requested instead of just throwing out IMG SRC's?
This might just be impossible, but figured I'd try asking the experts. Thanks for your time!

What you do is provide a proxy for the images:
<img src="imageServer.aspx?id=12345" />
What you do at your end it send the MIME header, then stream out the file. This way there is no direct relation between the image that is served and a particular filename.

You can create Bitmap class from the loaded Image and save the image, used to generate bitmap somewhere to validate user input

There's a good example of dynamic image creation on the MSDN site here
http://msdn.microsoft.com/en-us/library/system.web.httpresponse.outputstream.aspx

I would recommend to use a generic handler (*.ashx) for this. Much less overhead and a cleaner way to load an image that calling an aspx page.
I've used generic handlers for image purposes countless times. For instance you can provide server-side resizing. Another cool feature would be accessing session values, like "only show the image if the user is logged in"
Looking at http://www.codeproject.com/Articles/34084/Generic-Image-Handler-Using-IHttpHandler might be a good start.

Related

Is there a way to capture a view and save it?

We have many element(s) in a ContentPage. The goal is to take a picture of a specific element and then have access to that data - to save it or possibly other things such as cropping it.
So this question is twofold - is there a way to photographically capture a given element? Is there a way to do this if the element is not fully in view? Example a ScrollView would potentially have some of its elements not currently in view.
Our attempt at this is to use device specific screenshots and crop them to a given element. The screenshots are working, but we aren't having luck with cropping. Not to mention in the case as described above the screenshot will not work as the view isn't fully visible.
Is there a way to obtain the "graphical" (photo) data of an element at a given time even if it's not currently visible/partially visible?
Thanks for reading in advance.
After a lot of talking, this is what I understand
The Users of your application are the Workers of Your company
The application is for managing the accounts of your companies Customers
The Customers have no access to their data, in any shape or form
Part of the Customer Data is their Email Adress
You want to send a copy of their Data to the Customers
As Emails do not allow formating that well, you want to send that Data as a Screenshot of the UI.
If I got all that right:
You are neck-deep in a XY Problem. Or rather a ((XY)Y)Y Problem - a XY problem of the 3rd Generation.
The obvious solution would be to fix point 3 and give your customers access to their Data already:
You can do that via a extra Programm, App, a Webpage or anything similar. If they can receive emails, they can download a app or open a Webpage and see their data there. May need a login, but nothing special. There are even ways to encode data/direct links into Emails and register your Programm with a custom Format. Indeed, that is how Steam Links on the Desktop work.
Meanwhile the In-House user get a "Customer Management" Programm that allows more direct access to the Customers Data in the Database (I asume you got a backend Database. But it is at least possible you do not).
If you can not fix Option 3 for stupid Boss/Legal Reasons (these are the only Valid reasons I can Imagine. And I can not stress enoug how stupid the boss would have to be in that), you should at least be able to fix at Point 5/6:
The first Option would be to send Text Emails. People often underestimate jsut how much is possible with pure Text. It is basically like writing on a Console, but even that is enough medium to make a Art in it.
The other ways involve Managing the HTML limitations:
Save HTML Mail
The main security issue with HTML mails, is "downloading external content" part. Those operations can not be reliable scanned by Virus scanners and the like - especially in the age of HTTPS. Unless we talk about Kaspersky and the stupid Idea they had.
And even if they can be scanned reliable, even just the request of those files can be used for spam senders to verify the Email Adress is still in use. So it is a no-go too.
So you will need to Inline as much as possible. Inlining images is not that possible. While HTML totally has a Standart for that - you Base64 encode the binary into the HTML - this does not work reliably. At least Microsoft Outlook is known to interpret all Base64 images in the Email as Attachments - even the inlined ones. And even if they fixed this or it is no longer a relevant issue, inlining images tends to increase the HTML size significantly.
You can use CSS to some degree. But aside from inlining it, you might have to go back a step or two. In the end, Email Programms are really weak web-browsers. So they do not nessesarily support all the latest stuff instantly. Anything below CSS 3.0 should reliably work by now. But you better ask someone once you got more specific Requirements for this Email.
PDF Attachment
Somewhat more established is to create a .PDF file and send it. All those bills/other stuff in .PDF format you get - those have been created on demand from a Database, by the same code that also send the Email. In many cases the demand was automated too or the Sending Programm was a outright Background Process.
.PDF allows all Formating you could want. It can take up images inline. And there is plenty of ways to create .PDF from code. And as you can send it as a attachment, the Virus scanner has time to go over it. And we are not in the last Millenium, where a PDF Reader was a uncommon programm to have installed (I still remember the times when a current Version of Acrobat PDf Reader was delivered on every CD with a .PDF Format Handbook).
If you are stil dead serious about the whole "make a Image of the UI to send that", my only question is: How many Years have been aloted for that?

Invoking Photoshop filters (desaturation, resizing, change palette) from C#

I need to programmatically process some images using C#, and to match the results that our design team is achieving I would prefer to use Photoshop.
Is there a way to apply the filters mentioned in the title in the same way you would by using Photoshop's GUI, but through C#?
well personally havent tried it programmatically but maybe this one: http://www.pcpix.com/Photoshop/ might help you. Its basically an old reference, but give it a try it might still be valid. Otherwise, spend a few minutes to go through the page there: http://www.adobe.com/devnet/photoshop/scripting.html. Good luck

Replacing an image Flash wants to load

This is a rather weird question, so please bear with me.
There's a SWF file on one page that, when you click on a 'Start' button loads some image. The URL to this image is passed as a SWFObject variable. I would like to change this image to one I have uploaded on my host.
I have tried setting a breakpoint on the line that pushes the image URL variable to the object and setting my URL, but the image wouldn't load because of cross-domain policy.
Now I am thinking of writing a simple c# proxy which will return my image instead of the real one when Flash requests it ...
Do you perhaps have any better ideas on how this could be done?
To sum it up, I want to replace an image that SWF loads from a constant URL to a custom image of mine. Decompiling is not an option.
EDIT: I figured out the image-not-loading problem, it was cached after all.
Too long for comments:
It's entirely possible that your SWF file has the image embedded in itself. However, you say a number of things that sound very conflicting to me.
First off, you mention putting a breakpoint on the line that "pushes the image URL variable to the object" What, exactly, does this? Is that the C# code?
You also state that it doesn't load due to cross-domain policy. Have you resolved that? Also, why do you think that's the problem?
Why did you try replacing the image with other tools? Are you trying to manually get around a cross-domain policy restriction?
Finally, you ask state that you "can't figure out why the image packets are not being received." Before we go that far, are they even being requested? You mention that wireshark doesn't even see the request going out..
I guess all of this boils down to:
1. Do you have control over where the SWF loads the image from?
2. If so, is that request being made? You should be able to see this from your server logs.

how to download the image which will be displayed after a cache image on the web page?

I want to download an image from a cartoon website. and my app is WinForm,not WebForm.
So let's say that there is an image on the a.html.
Normally, when I click the previous page and am redirected to this page,
there will be a image :"image is loading",let's say A.jpg, in the same block.
After 5 seconds, the real one,let's say B.jpg, will be displayed.
So what I got is only the caching image rather than the one,B.jpg, which I want.
So..... how should I do it?
Thanks in advance.
ps: I have posted this qustion for more than 48 hours, and only got a few of answers which don't solve my problem.
I am wondering that why there are only 2 people posted their answers?
Is my question not clear?
If any, please let me know.
Thanks
EDIT: Original answer removed since I misunderstood the question entirely.
What you want to do is basically HTML scraping: using the actual html of the page to discover where files are hosted and download them. Because I'm not sure if there are any legal reasons that would prevent you from downloading the image files in this manner, I'm just going to outline an approach to doing this and not provide any working samples or anything. In other words, use this information at your own risk.
Using fiddler2 in Firefox, you should be able to find the domain and full url that one of the images is downloaded from. Basically just start fiddler2, navigate to the site in firefox, and then look for the biggest file that is downloaded. That will tell you exactly where the image is coming from.
Next, take a look at the HTML source code for the page you are viewing. The way this particular site works, it looks like it hides the previous/next downloads in a swf or something, but you can find the urls in the javascript for the page. Look for a javascript array called picArr.
To download these using a WinForms app, I would use the WebRequest object. Create a request for each image url and save the response to disk.

Generate page dynamically & insert body into another page - is this realistic?

I have the requirement to create a page which contains a graph at the top, and for each item in the graph there's a fact sheet below. I already produce the fact sheets as stand-alone pages. Now, rather than recreating the fact sheet to include in the page I have to create, I'd like to use the work that already exists.
Is it realistic that I dynamically generate each fact sheet as needed, strip out the body and insert that into the new page? If so, does anyone have any pointers or suggestions? Thanks
I would suggest moving the content of the existing page into an ASCX user control - it should be a fairly quick job, and then you can incorporate it into other pages as required.
A quick way to implement this feature would be to use an iframe to load the other pages in to. This would allow you to keep using the work that already exists. Not the most elegant solution but it would work.
Hope this helps.
No, generating stuff you don't need and then removing it is inelegant at best, hackish, and will likely contribute to lowering the quality (including reliability, security etc.) of your code.
Refactor your factsheet page code to generate a header, but use a self-contained class/widget to generate the actual factsheet content. Then just instanciate and use that same class/widget on the other page as well.

Categories

Resources