0

I am looking forward to logging on to a site from php curl. The problem is that to log in, he asks me to pass a google recaptcha. I have previously done this by checking the recaptcha from my platform, but now this captcha has the domain lock and I can't use its "data-sitekey". My current code ..

<?php
if(isset($_POST['g-recaptcha-response'])){

    $cookie="cookie.txt"; 
    if(!file_exists($cookie)){
            $fh = fopen($cookie, "w");
            fwrite($fh, "");
            fclose($fh);
    }
        $captcha=$_POST['g-recaptcha-response'];

        $postdata = "username=xxx&password=xxx&g-recaptcha-response=$captcha"; 
        $ch = curl_init(); 
        curl_setopt ($ch, CURLOPT_URL, "REMOTE URL LOGIN"); 
        curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
        curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6"); 
        curl_setopt ($ch, CURLOPT_TIMEOUT, 60); 
        curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1); 
        curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt ($ch, CURLOPT_COOKIE,1);
        curl_setopt ($ch, CURLOPT_COOKIEJAR,$cookie);
        curl_setopt ($ch, CURLOPT_COOKIEFILE,$cookie); 

        curl_setopt ($ch, CURLOPT_POSTFIELDS, $postdata); 
        curl_setopt ($ch, CURLOPT_POST, 1); 

        $result = curl_exec($ch);

        echo $result;
}else{
?>
    <script src="//www.google.com/recaptcha/api.js" type="text/javascript"></script>
    <form method="post" action="" name="signup-form">
        <center><div class="g-recaptcha" data-theme="light" data-sitekey="SITEKEYREMOTELOGIN"></div></center>
        <button type="submit" name="submit">SUBMIT</button>
    </form>
<?php
}
?>
  • 1
    Sounds like the owner of that site does not want to you bypass that measure he has taken. I'd they that you should not, then. – arkascha Sep 26 '19 at 19:39
  • **[You should not switch off `CURLOPT_SSL_VERIFYHOST` or `CURLOPT_SSL_VERIFYPEER`](https://paragonie.com/blog/2017/10/certainty-automated-cacert-pem-management-for-php-software)**. It could be a security risk! [Here is how to get the certificate bundle if your server is missing one](https://stackoverflow.com/a/32095378/1839439) – Dharman Oct 02 '19 at 22:42

0 Answers0