I don't recommend this script:

1. there's a critical vulnerability that can be used to bypass timer (reported in PM)
2. the way it's written is just asking for a SQL Injection vulnerability. Instead of using prepared statements or an ORM, variables are escaped in random places. I've already found an instance of variable that's escaped twice, it's not hard to imagine there is (or will be introduced in an update) a variable that's not escaped at all.
3. superglobal variables are overwritten
4. getipintel have a limit of 500 queries and will be too expensive to be used by faucets, so this bot shield is useless

Probably around 17:00 UTC

Please upload this script to your hosting and send me a link to it: https://faucetinabox.com/static/download/tools/test.php

BTW the bug here in Faucet in a BOX script r69 is that is says "FaucetBOX.com" instead of "FaucetHUB.io", but it doesn't change the fact that it's probably your hosting that prevents the script from connecting to faucethub.

Unfortunately no, things are changing too fast, such a review would be outdated after a week.

However I can recommend one thing: don't use other faucet scripts. I've done small code review of them and I could find serious vulnerabilities in all of them. I'm talking about things that allow bypassing timer and in one case also captcha. I've reported most of them, but I wasn't satisfied in how my reports were handled. And I didn't even do a thorough testing, I just spent 5 minutes looking at code of each script. That doesn't include FaucetHUB.io, as they don't have their own script yet, but it does include elbandi's Minifaucet.

I'll give my random thoughts though:

1. I trust ePay.info the most, but that's only because it seems like there's more than one person behind it. It has highest "Bus factor" (https://en.wikipedia.org/wiki/Bus_factor). However I do have many issues with them. They seem to be adding features too fast and without proper testing since FaucetBOX.com announcement. I don't know how it looks now, but historically their support was terrible. From posts in their topic I suspect they're having problems with data consistency. They're here since 2 years (they claim they have 3 years of experience, but FaucetBOX.com is here for only 2 years and I'm pretty sure FaucetBOX.com launched before them) and didn't steal any coins, thats a good sign too.
2. FaucetSystem.com seems to be run by just one person (Bus factor = 1...), which is a problem. They also made many common mistakes when launching, I don't think it's being run by someone with experience in sysops. Just like with ePay.info, I suspect they're having problems with data consistency. They copied some things directly from FaucetBOX.com, which I don't like (the features for owners/users on main page). They're kinda lying about fees (they claim "No system fees for users" but they do have fees for users). They responded best for my vulnerability reports (both in site itself and script) though, which is a plus.
3. FaucetHub.io seems to be run by just one person (Bus factor = 1), which is a problem. However I must say they their launch was pretty professional and it seems their codebase is well tested. I didn't read anything that would suggest data inconsistencies. They require users to register on FaucetHub.io, which may or may not be a problem for you. Personally I would use FaucetHub.io if only mexicantarget's wasn't the only maintainer. EDIT: I've just read about this: https://bitcointalk.org/index.php?topic=1672870.msg17139016#msg17139016 . So it looks like they're pushing it a little bit too fast, just like ePay.info. That said, bugs huppen and they handled this correctly.

So my best advice is: diversify. Create faucets with each service. And as always, keep only as much coins in services as you need. Your coins are safe only if you, and only you, own the private key.

Dang, it should be: https://faucetinabox.com/static/download/tools/test.php

You have to somehow pass the parameter to iframe. I don't know Wordpress, but if you can use PHP with it, something like this should help:


Then if you visit http://claimbits.com/?r=bitcoin_address it will be passed to the iframe and will be picked up by faucet too.

---

Your hosting probably uses a reverse proxy, so for the script it looks like all users are coming from single IP address.

Please upload this script to your server and send me a link to it:
https://faucetinabox.com/static/downloads/tools/test.php

Yea, it depends entirely on your hosting.

Faucet in a BOX r69 now supports FaucetHub.io out of the box. Just select it in the admin panel.

Faucet in a BOX r69 now supports FaucetHub.io out of the box. Just select it in the admin panel.

Faucet in a BOX r69 now supports FaucetHub.io out of the box. Just select it in the admin panel.

Faucet in a BOX r69 now supports FaucetHub.io out of the box. Just select it in the admin panel.

It should be fine.

Make sure you have $display_errors = true; and PM me your faucet's address.


About a week probably.


This captcha doesn't use any keys, it's local.

Not only Xapo uses P2SH (https://en.bitcoin.it/wiki/Pay_to_script_hash) addresses. Many wallets do and it's a great way to increase security of coins.
There are also P2SH addresses for other currencies. However note that P2SH addresses for Bitcoin and Litecoin are indistinguishable, which means that a valid Bitcoin P2SH address is also valid Litecoin P2SH address. If you expect that address itself can be used as a unique qualifier, that may be problematic.

Are you okay with small pentesting during beta? Just random checks for XSS, CSRF etc. (I'm a sysadmin, not a pentester, so don't rely on me finding nothing )

EDIT:

How long will beta last?

Rotator users rarely check the reward, they just go through each site showed to them. Bots don't use frames.
That said rotator users also doesn't click ads, so I understand why people may want to block them.

You're confusing bots with rotators. You didn't ban bots, you banned legitimate users that use rotators.

Can you save this script: http://pastebin.com/raw/cfgJgb5u as test-captcha.php on your hosting (the same place where you uploaded faucet script that has captcha problems) and send me a link to it?


Something went wrong when you uploaded files, try uploading again.

That depends on hosting. If you don't know where your hosting keeps error logs, you can also set $display_errors = true; in config.php and try visiting http://faucetdomain.com/cool-captcha.php . Then you should see errors on screen (I hope).

Any errors in logs?