W 20: reCAPTCHA (15 pts)

What You Need

A Linux machine,. I used a Debian 10 Google Cloud Server.

Making a reCAPTCHA Account

Open a Web browser and go to

http://www.google.com/recaptcha/admin

A Google login page appears. Log in with a Gmail account.

Click the "Get reCAPTCHA!" button.

In the next page, enter these items, replacing the IP address with the IP address of your Linux server:

Don't use the literal text "YOURNAME" -- use your own name.

At the bottom of the page, click the blue SUBMIT button. A page appears with two keys, as shown below.

Keep this page open. You will need to paste those two keys into the files you create below.

Installing Apache & PHP

In an SSH session, execute these commands: 
sudo apt update
sudo apt install apache2 php libapache2-mod-php -y
Enter your password when you are prompted to.

Starting Apache

In an SSH session, execute these commands: 
sudo service apache2 restart
sudo ss -plnt
You should see apache2 listening on port 80, as shown below:

Testing PHP

On your Kali machine, in a Terminal window, execute this command:
sudo nano /var/www/html/test.php
In nano, enter the code shown below:
<?php phpinfo(); ?>

Your screen should look like this:

Press Ctrl+X<, then press Y, Enter to save the file.

Find the IP address of your Linux server. If you are using Google Cloud, it's the "External IP" in Google Cloud Console, as shown below:

In a Web browser, go to this address, replacing the IP address with your Web server's IP:

http://35.239.106.169/test.php
You should see a PHP configuration page, as shown below:

This verifies that Apache and PHP are running correctly.

Making a Form

On your Linux machine, in a Terminal window, execute this command:
sudo nano /var/www/html/YOURNAME-form.html

Replace the text "YOURNAME" with your own name, but don't use any spaces.

Enter this HTML code into the form, replacing YOURNAME with your name in two places, as highlighted in the image below:

<html>
<head><title>YOURNAME reCAPTCHA Form</title>
<script src="https://www.google.com/recaptcha/api.js" async defer></script>
</head>
<body>
<h1>YOURNAME reCAPTCHA Form</h1>
<form method="post" action="captcha.php">
<div class="g-recaptcha" data-sitekey="9LDDpf0eVtMZY6kdJnGhsYYY-5ksd-W"></div>
<input type="submit" />
</form>
</body>
</html>

Replace the data-sitekey value with your site key you found at the start of this project, as highlighted in the image below.

Replace YOURNAME with your name in two places.

Save the file with Ctrl+X, Y, Enter.

Making the PHP Processor Script

On your Linux machine, in a Terminal window, execute this command:
sudo nano /var/www/html/captcha.php

Enter this PHP code into the file. 

<?php
if(isset($_POST['g-recaptcha-response']) && !empty($_POST['g-recaptcha-response'])):
    //your site secret key
    $secret = '6LchiMoSAAAAACk_2af1Z5J_FsZLwSC1sOr6VXR0';
    //get verify response data
    $verifyResponse = file_get_contents(
        'https://www.google.com/recaptcha/api/siteverify?secret='.
        $secret.'&response='.$_POST['g-recaptcha-response']);
    $responseData = json_decode($verifyResponse);
    if($responseData->success):
        echo "<h1>YOURNAME reCAPTCHA Succeeded!</h1>";
    else:
        echo "<h1>Robot verification failed, please try again.</h1>";
    endif;
else:
   echo '<h1>Please click on the reCAPTCHA box.</h1>';
endif;
?>

Replace the $secret value with your secret key you found at the start of this project, as highlighted in the image below.

Replace YOURNAME with your name.

Save the file with Ctrl+X, Y, Enter.

Testing the PHP Script

On your Linux machine, in a Terminal window, execute this command:
php /var/www/html/captcha.php

You should see a message saying "Please click on the reCAPTCHA box", as shown below.

If you have errors in your PHP script, you will see error messages here that will guide you in fixing them.

Testing the Form

In a Web browser, go to this address, replacing the IP address with your Web server's IP:
http://35.239.106.169/YOURNAME-form.html
In a Web browser, go to localhost/YOURNAME-form.html page.

You should see a reCAPTCHA form, as shown below.

Check the box.

A task appears, as shown below. Complete the task.

A green check box appears.

Click the Submit button.

You should succeed, as shown below.

W 20.1: Flag (15 pts)

The flag is the word covered by a green rectangle in the image below.

Sources

Using new Google reCAPTCHA with PHP

Updated to flag system 6-11-2020