turnley.dev

PHP and MySQL code for faucet operators

Tools & Calculators

ADL-007

Checking an AdsLab captcha solve

session-info answers pending for any token, including invented ones, so only the solved check means anything.

The monetised captcha pays per solve, which makes it the one ad unit users will not skip. Verifying it has a trap: the session-info endpoint answers success: true, status: "pending" for any token at all, including a string you made up.

So a handler that treats a successful HTTP response as proof of a solve accepts anything. The only meaningful check is the solved state itself.

AL Captcha Pro's verify behaves more conventionally, with one quirk worth knowing: they advise omitting remoteip entirely rather than sending the visitor's address.

PHP 
function adslab_captcha_solved(string $apiKey, string $token): bool
{
    if ($token === '') {
        return false;
    }

    $body = fetch_guarded('https://adslab.me/api/captcha/session-info?token=' . rawurlencode($token), 10);
    $data = $body === null ? null : json_decode($body, true);

    // success:true means the CALL worked, not that anyone solved anything —
    // any token at all gets that answer, with status "pending".
    if (!is_array($data)) {
        return false;
    }

    return (string) ($data['status'] ?? '') === 'solved';
}

function alcaptcha_verify(string $securityHash, string $response): bool
{
    if ($response === '') {
        return false;
    }
    $ch = curl_init('https://adslab.me/api/captcha/siteverify');
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        // AdsLab advise NOT sending remoteip here.
        CURLOPT_POSTFIELDS     => http_build_query(['secret' => $securityHash, 'response' => $response]),
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 10,
        CURLOPT_SSL_VERIFYPEER => true,
    ]);
    $raw = curl_exec($ch);
    curl_close($ch);

    $data = json_decode((string) $raw, true);
    return is_array($data) && ($data['success'] ?? false) === true;
}

Using it

Fall back to another captcha when theirs fails to load. On a validation gate, a captcha that will not render is a site nobody can use.

Use the paid captcha where it is worth a solve — once per session on a validation page — rather than on every form, where it becomes friction you are barely paid for.

A solve pays a fraction of a cent. Treat it as retention spend, not revenue.

What bites people

Do not accept success: true as a solve. That is the bug this entry exists for.

Tokens are single use. Record the one you accepted so a replay within the window does not pass twice.

If the captcha is also your bot defence, decide what happens when the network is down: fail closed and lose signups, or fall back to a free captcha.

Also in Ad Networks and Offerwalls