Advanced Search

Carding ✅ Creating Your Own Checker Via Stripe ✅

0

0x262

Active Carder
Joined
27.07.25
Messages
25
Reaction score
3
Points
3
d0ctrine said:
View attachment 53318
✅ Creating Your Own Checker Via Stripe ✅

Checker services are in absolute shambles right now. Their services are dropping like flies - either going completely offline or becoming so unreliable they might as well be. The working ones? Theyre either slow as shit or spitting out more false declines than actual results. No wonder my inbox is flooded with the same question "How do I make my own checker?"

Well Im finally going to break it all down. Creating your own checker is a complex beast with multiple approaches but were going to tackle it step by step. This guide is the first in a series where well explore different methods starting with the most straightforward one: checking cards via Stripes API.

Right now youre working with the bare essentials a Stripe checker that can check a single card at a time; the next guide will amp things up with mass-checking techniques 3DS checks and explorations into other merchant integrations.


Why Stripe Though?

If youve been following my writeups you already know my stance on this: checking via Stripe is bad. Not because it "kills" cards - thats technically not true. The real issue is Stripe's Radar system blacklisting (generic_decline) your cards. Every single card you run through a Stripe checker gets flagged as part of a "card testing" attack and good fucking luck using that card on any Stripe-powered site afterward.

But desperate times call for desperate measures. Maybe youre hitting non-Stripe sites anyway or you just need a quick validity check. The method still works - just understand what you're getting yourself into.


Stripe API And Binners

View attachment 53321

Those binners we roasted earlier? Turns out theyre the same ones running these "SK checker services" - mostly operated by tech-savvy Indians whove figured out how to automate their garbage strategy. They manually generate and test bulk cards by scraping e-commerce sites for public Stripe keys. Same monkey-typewriter approach just with fancier tools.
And its not just Stripe they're targeting. Braintree Square any payment processor with public keys exposed on websites gets hammered by these scripts. But we're focusing on Stripe today because it's the most widespread and their API is actually decent to work with even if these clowns are abusing it.

Here's how Stripe checking works under the hood:

  • Tokenization: Your card details get converted into a one-time token
  • Payment Method Creation: That token becomes a "payment method"
  • Auth Options: You can either just bind the card (no charge) or run a small auth charge ($0.50-$1) to verify funds

Building Your Own Checker

Alright lets get you set up with Stripe in a way that doesnt leave you looking like a clueless rookie.

1. Prep Your Gear:
  • Premium US proxy - Stripes fraud detection will flag cheap proxies instantly. Residential proxies are your best bet here.
  • Legit identity details (SSN + DOB). Half-assed fake info is a one-way ticket to account termination.
  • Business front browse Flippa.com for a small established e-commerce site. Copy their business model and details - this helps you sail through Stripe's verification process.
  • Banking info any plausible routing and account numbers will work since were not actually processing payments. Just make sure the numbers follow the correct format.

2. Setting Up Your Stripe Account:
  • Quality fullz (SSN DOB address etc). Bender-Search is my current go-to - their data is accurate and cheap at 50 cents per set. While other vendors exist Benders quality has been consistently solid.View attachment 53323
  • Register at stripe.com using an email that you have access to.
  • Personal info use the name and DOB from your fullz. The SSN needs to match perfectly.
    View attachment 53325
  • Business details:
  • Bank details:
    • When prompted for bank details select "Enter Bank Details Manually" - not doing so will prompt Plaid which we dont want
    • Look up a real routing number from a bank in your fullz's city
    • Generate a random 10-12 digit account number
    • Use the same name as your personal info
  • Once verified grab your API keys from the dashboard - youll need these for the checker


3. The Checker Setup:
Back in the day you could simply use your sk_live key and run a Python script to bust out a token and verify a card. Nowadays, Stripe isnt that stupid – if you try sending raw credit card numbers directly youll get hit with an error like this:



Code: 
{
  "charge": null,
  "code": null,
  "decline_code": null,
  "doc_url": null,
  "message": "Sending credit card numbers directly to the Stripe API is generally unsafe. To continue processing use Stripe.js, the Stripe mobile bindings, or Stripe Elements. For more information, see https://dashboard.stripe.com/account/integration/settings. If you are qualified to handle card data directly, see https://support.stripe.com/questions/enabling-access-to-raw-card-data-apis.",
  "param": null,
  "payment_intent": null,
  "payment_method": null,
  "request_log_url": "https://dashboard.stripe.com/logs/req_21941209",
  "setup_intent": null,
  "source": null,
  "type": "invalid_request_error"
}


Instead of getting away with a direct API call you now must use Stripes JavaScript frontend to collect and tokenize card details. There are workarounds out there – I'll dive deeper into those in a future guide – but for this surface-level approach were switching to a simple PHP server setup.

Here's what you need to do:

  1. Place the following filesin one folder:
    • index.html
    • validate.php
    • composer.json
  2. Run "composer install" to install the Stripe PHP module.
  3. Host the folder locally (using XAMPP WAMP or any plain PHP server).
  4. Open index.html in your browser. It will prompt you for your sk_live and pk_live keys then display a secure Stripe payment field.
  5. Enter your card details; once submitted the backend (validate.php) uses a Payment Intent to validate the cards legitimacy and returns a response.

Below is the complete code for this setup. (Seriously – dont modify any of this stuff.)

Code: 
index.html:
Code: 
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Card Validator</title>
    <script src="https://js.stripe.com/v3/"></script>
    <style>
        body {
            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;
            padding: 20px;
            background: #f0f0f0;
        }
        .card-validator {
            max-width: 500px;
            margin: 0 auto;
            background: white;
            padding: 20px;
            border-radius: 8px;
            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
        }
        h2 {
            color: #32325d;
            text-align: center;
            margin-bottom: 24px;
        }
        .form-group {
            margin-bottom: 16px;
        }
        label {
            display: block;
            margin-bottom: 8px;
            color: #32325d;
        }
        input {
            width: 100%;
            padding: 8px 12px;
            border: 1px solid #e4e4e4;
            border-radius: 4px;
            font-size: 16px;
            margin-bottom: 16px;
        }
        .card-element {
            padding: 12px;
            border: 1px solid #e4e4e4;
            border-radius: 4px;
            margin-bottom: 16px;
        }
        button {
            background: #5469d4;
            color: white;
            padding: 12px 24px;
            border: none;
            border-radius: 4px;
            font-size: 16px;
            cursor: pointer;
            width: 100%;
        }
        button:disabled {
            background: #93a3e8;
            cursor: not-allowed;
        }
        .status {
            margin-top: 16px;
            padding: 12px;
            border-radius: 4px;
            text-align: center;
        }
        .error {
            background: #fee;
            color: #ff0000;
        }
        .success {
            background: #e8ffe8;
            color: #008000;
        }
    </style>
</head>
<body>
    <div class="card-validator">
        <h2>Card Validator</h2>
        <div id="setup-form">
            <div class="form-group">
                <label>Secret Key (sk_live):</label>
                <input type="text" id="sk_live" required>
            </div>
            <div class="form-group">
                <label>Public Key (pk_live):</label>
                <input type="text" id="pk_live" required>
            </div>
            <button onclick="setupStripe()">Continue</button>
        </div>

        <div id="card-form" style="display: none;">
            <form id="payment-form">
                <div class="form-group">
                    <label>Card Details:</label>
                    <div id="card-element" class="card-element"></div>
                </div>
                <button type="submit" id="submit-button">Validate Card</button>
            </form>
            <div id="status" class="status" style="display: none;"></div>
        </div>
    </div>

    <script>
        let stripe;
        let elements;
        let card;
        let sk_live;

        function setupStripe() {
            const pk_live = document.getElementById('pk_live').value;
            sk_live = document.getElementById('sk_live').value;

            if (!pk_live || !sk_live) {
                alert('Please enter both keys');
                return;
            }

            stripe = Stripe(pk_live);
            elements = stripe.elements();
            card = elements.create('card');
       
            document.getElementById('setup-form').style.display = 'none';
            document.getElementById('card-form').style.display = 'block';
       
            card.mount('#card-element');
        }

        document.getElementById('payment-form').addEventListener('submit', async function(e) {
            e.preventDefault();
       
            const submitButton = document.getElementById('submit-button');
            const statusDiv = document.getElementById('status');
       
            submitButton.disabled = true;
            submitButton.textContent = 'Processing...';
            statusDiv.style.display = 'block';
            statusDiv.textContent = 'Validating card...';
            statusDiv.className = 'status';

            try {
                const { paymentMethod, error } = await stripe.createPaymentMethod({
                    type: 'card',
                    card: card,
                });

                if (error) {
                    throw error;
                }

                const response = await fetch('validate.php', {
                    method: 'POST',
                    headers: {
                        'Content-Type': 'application/json',
                    },
                    body: JSON.stringify({
                        payment_method_id: paymentMethod.id,
                        secret_key: sk_live,
                    }),
                });

                const result = await response.json();

                if (result.error) {
                    throw new Error(result.error);
                }

                // Handle 3D Secure authentication if required
                if (result.requires_action) {
                    statusDiv.textContent = 'Additional authentication required...';
                    const { error: confirmError } = await stripe.confirmCardSetup(
                        result.client_secret
                    );
                    if (confirmError) {
                        throw confirmError;
                    }
                    statusDiv.textContent = 'Card is Live! ✅';
                    statusDiv.className = 'status success';
                    return;
                }

                let message = '';
                switch (result.status) {
                    case 'succeeded':
                        message = 'Card is Live! ✅';
                        break;
                    case 'processing':
                        message = 'Card validation is still processing...';
                        break;
                    case 'requires_action':
                        message = 'Card requires additional verification.';
                        break;
                    default:
                        message = `Card validation status: ${result.status}`;
                }

                statusDiv.textContent = message;
                statusDiv.className = result.success ? 'status success' : 'status error';
            } catch (error) {
                statusDiv.textContent = `❌ Declined: ${error.message}`;
                statusDiv.className = 'status error';
            } finally {
                submitButton.disabled = false;
                submitButton.textContent = 'Validate Card';
            }
        });
    </script>
</body>
</html>

Code: 
validate.php:
Code: 
<?php

header('Access-Control-Allow-Origin: *');
header('Content-Type: application/json');
header('Access-Control-Allow-Methods: POST');
header('Access-Control-Allow-Headers: Content-Type');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit();
}

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['error' => 'Method not allowed']);
    exit();
}

require_once '../vendor/autoload.php';

// Ensure the input is valid JSON before decoding
$rawInput = file_get_contents('php://input');
if (!isValidJson($rawInput)) {
    http_response_code(400);
    echo json_encode(['error' => 'Invalid JSON input']);
    exit();
}

$input = json_decode($rawInput, true);
$payment_method_id = $input['payment_method_id'] ?? null;
$secret_key = $input['secret_key'] ?? null;

if (!$payment_method_id || !$secret_key) {
    http_response_code(400);
    echo json_encode(['error' => 'Missing required parameters']);
    exit();
}

// Helper function to validate JSON
function isValidJson($string) {
    json_decode($string);
    return json_last_error() === JSON_ERROR_NONE;
}

try {
    \Stripe\Stripe::setApiKey($secret_key);

    // Create a SetupIntent and confirm it with the payment method
    $setup_intent = \Stripe\SetupIntent::create([
        'payment_method' => $payment_method_id,
        'confirm' => true,
        'usage' => 'off_session',
        'return_url' => 'https://crdpro.cc',
        'automatic_payment_methods' => [
            'enabled' => true,
            'allow_redirects' => 'never'
        ]
    ]);

    // Check the status
    $status = $setup_intent->status;
    $success = in_array($status, ['succeeded', 'requires_action', 'processing']);

    // If 3D Secure authentication is required
    if ($status === 'requires_action' || $status === 'requires_source_action') {
        echo json_encode([
            'success' => false,
            'status' => $status,
            'setup_intent' => $setup_intent->id,
            'client_secret' => $setup_intent->client_secret,
            'requires_action' => true
        ]);
        exit();
    }

    echo json_encode([
        'success' => $success,
        'status' => $status,
        'setup_intent' => $setup_intent->id
    ]);
} catch (\Exception $e) {
    http_response_code(400);
    echo json_encode([
        'error' => $e->getMessage(),
        'type' => get_class($e)
    ]);
}

[code]composer.json:
Code: 
{
    "require": {
        "stripe/stripe-php": "^13.0"
    }
}

*** Hidden text: cannot be quoted. ***



Once everything's setup properly:




Some Other Stuff To Remember


The whole deal with binding versus auth is simple. Binding merely creates a payment method which is like filing away your card details without much fanfare. Auth on the other hand actually attempts to charge a tiny amount (think $0 or a few bucks) to verify the card. It gives you better clarity on whether a card is active but it also leaves a more noticeable trace and risk of killing the card.

When it comes to account management Stripe is merciless. The moment you start running patterns that look sketchy theyll slam the brakes and nuke your account. Your best bet? Rotate through multiple Stripe accounts use different IP addresses for each and keep your card-checking volume within reasonable limits. Don't be the idiot who thinks running a mountain of tests on a single account is a good idea.

Finally error handling is your lifeline. Learn how to dissect each error message—sometimes it means the card is toast; other times it's just Stripe being a stubborn bitch. Either way understanding these messages means you can adjust your approach on the fly.

This isn't rocket science but if you ignore these pointers youll be stumbling around like a rookie. Use these strategies to stay a step ahead and remember: the devil's in the details.


More To Come

This is just the beginning of our checker creation series as such it is extremely basic and simple. We've started with the training wheels version - Stripe API checking. In upcoming guides well dive into the real shit: building your own auth systems and mass checker working with different payment processors, creating your own Telegram CC Checker bot, etc, and creating checkers that actually give you useful data beyond "valid/invalid."

Remember: A checker is only as good as its operator. Don't be the dipshit running 10,000 cards through one Stripe account and wondering why it got banned. Start small understand the mechanics and scale up smart.

Stay tuned for the next guide in this series. Were going to get into the specifics of building checkers that actually deserve to be called tools not toys. d0ctrine out.
Click to expand...
im looking for this good stuff thanks bro
 
R

rizekamishino

Carding Novice
Joined
28.07.25
Messages
2
Reaction score
0
Points
1
d0ctrine said:
View attachment 53318
✅ Creating Your Own Checker Via Stripe ✅

Checker services are in absolute shambles right now. Their services are dropping like flies - either going completely offline or becoming so unreliable they might as well be. The working ones? Theyre either slow as shit or spitting out more false declines than actual results. No wonder my inbox is flooded with the same question "How do I make my own checker?"

Well Im finally going to break it all down. Creating your own checker is a complex beast with multiple approaches but were going to tackle it step by step. This guide is the first in a series where well explore different methods starting with the most straightforward one: checking cards via Stripes API.

Right now youre working with the bare essentials a Stripe checker that can check a single card at a time; the next guide will amp things up with mass-checking techniques 3DS checks and explorations into other merchant integrations.


Why Stripe Though?

If youve been following my writeups you already know my stance on this: checking via Stripe is bad. Not because it "kills" cards - thats technically not true. The real issue is Stripe's Radar system blacklisting (generic_decline) your cards. Every single card you run through a Stripe checker gets flagged as part of a "card testing" attack and good fucking luck using that card on any Stripe-powered site afterward.

But desperate times call for desperate measures. Maybe youre hitting non-Stripe sites anyway or you just need a quick validity check. The method still works - just understand what you're getting yourself into.


Stripe API And Binners

View attachment 53321

Those binners we roasted earlier? Turns out theyre the same ones running these "SK checker services" - mostly operated by tech-savvy Indians whove figured out how to automate their garbage strategy. They manually generate and test bulk cards by scraping e-commerce sites for public Stripe keys. Same monkey-typewriter approach just with fancier tools.
And its not just Stripe they're targeting. Braintree Square any payment processor with public keys exposed on websites gets hammered by these scripts. But we're focusing on Stripe today because it's the most widespread and their API is actually decent to work with even if these clowns are abusing it.

Here's how Stripe checking works under the hood:

  • Tokenization: Your card details get converted into a one-time token
  • Payment Method Creation: That token becomes a "payment method"
  • Auth Options: You can either just bind the card (no charge) or run a small auth charge ($0.50-$1) to verify funds

Building Your Own Checker

Alright lets get you set up with Stripe in a way that doesnt leave you looking like a clueless rookie.

1. Prep Your Gear:
  • Premium US proxy - Stripes fraud detection will flag cheap proxies instantly. Residential proxies are your best bet here.
  • Legit identity details (SSN + DOB). Half-assed fake info is a one-way ticket to account termination.
  • Business front browse Flippa.com for a small established e-commerce site. Copy their business model and details - this helps you sail through Stripe's verification process.
  • Banking info any plausible routing and account numbers will work since were not actually processing payments. Just make sure the numbers follow the correct format.

2. Setting Up Your Stripe Account:
  • Quality fullz (SSN DOB address etc). Bender-Search is my current go-to - their data is accurate and cheap at 50 cents per set. While other vendors exist Benders quality has been consistently solid.View attachment 53323
  • Register at stripe.com using an email that you have access to.
  • Personal info use the name and DOB from your fullz. The SSN needs to match perfectly.
    View attachment 53325
  • Business details:
  • Bank details:
    • When prompted for bank details select "Enter Bank Details Manually" - not doing so will prompt Plaid which we dont want
    • Look up a real routing number from a bank in your fullz's city
    • Generate a random 10-12 digit account number
    • Use the same name as your personal info
  • Once verified grab your API keys from the dashboard - youll need these for the checker


3. The Checker Setup:
Back in the day you could simply use your sk_live key and run a Python script to bust out a token and verify a card. Nowadays, Stripe isnt that stupid – if you try sending raw credit card numbers directly youll get hit with an error like this:



Code: 
{
  "charge": null,
  "code": null,
  "decline_code": null,
  "doc_url": null,
  "message": "Sending credit card numbers directly to the Stripe API is generally unsafe. To continue processing use Stripe.js, the Stripe mobile bindings, or Stripe Elements. For more information, see https://dashboard.stripe.com/account/integration/settings. If you are qualified to handle card data directly, see https://support.stripe.com/questions/enabling-access-to-raw-card-data-apis.",
  "param": null,
  "payment_intent": null,
  "payment_method": null,
  "request_log_url": "https://dashboard.stripe.com/logs/req_21941209",
  "setup_intent": null,
  "source": null,
  "type": "invalid_request_error"
}


Instead of getting away with a direct API call you now must use Stripes JavaScript frontend to collect and tokenize card details. There are workarounds out there – I'll dive deeper into those in a future guide – but for this surface-level approach were switching to a simple PHP server setup.

Here's what you need to do:

  1. Place the following filesin one folder:
    • index.html
    • validate.php
    • composer.json
  2. Run "composer install" to install the Stripe PHP module.
  3. Host the folder locally (using XAMPP WAMP or any plain PHP server).
  4. Open index.html in your browser. It will prompt you for your sk_live and pk_live keys then display a secure Stripe payment field.
  5. Enter your card details; once submitted the backend (validate.php) uses a Payment Intent to validate the cards legitimacy and returns a response.

Below is the complete code for this setup. (Seriously – dont modify any of this stuff.)

Code: 
index.html:
Code: 
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Card Validator</title>
    <script src="https://js.stripe.com/v3/"></script>
    <style>
        body {
            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;
            padding: 20px;
            background: #f0f0f0;
        }
        .card-validator {
            max-width: 500px;
            margin: 0 auto;
            background: white;
            padding: 20px;
            border-radius: 8px;
            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
        }
        h2 {
            color: #32325d;
            text-align: center;
            margin-bottom: 24px;
        }
        .form-group {
            margin-bottom: 16px;
        }
        label {
            display: block;
            margin-bottom: 8px;
            color: #32325d;
        }
        input {
            width: 100%;
            padding: 8px 12px;
            border: 1px solid #e4e4e4;
            border-radius: 4px;
            font-size: 16px;
            margin-bottom: 16px;
        }
        .card-element {
            padding: 12px;
            border: 1px solid #e4e4e4;
            border-radius: 4px;
            margin-bottom: 16px;
        }
        button {
            background: #5469d4;
            color: white;
            padding: 12px 24px;
            border: none;
            border-radius: 4px;
            font-size: 16px;
            cursor: pointer;
            width: 100%;
        }
        button:disabled {
            background: #93a3e8;
            cursor: not-allowed;
        }
        .status {
            margin-top: 16px;
            padding: 12px;
            border-radius: 4px;
            text-align: center;
        }
        .error {
            background: #fee;
            color: #ff0000;
        }
        .success {
            background: #e8ffe8;
            color: #008000;
        }
    </style>
</head>
<body>
    <div class="card-validator">
        <h2>Card Validator</h2>
        <div id="setup-form">
            <div class="form-group">
                <label>Secret Key (sk_live):</label>
                <input type="text" id="sk_live" required>
            </div>
            <div class="form-group">
                <label>Public Key (pk_live):</label>
                <input type="text" id="pk_live" required>
            </div>
            <button onclick="setupStripe()">Continue</button>
        </div>

        <div id="card-form" style="display: none;">
            <form id="payment-form">
                <div class="form-group">
                    <label>Card Details:</label>
                    <div id="card-element" class="card-element"></div>
                </div>
                <button type="submit" id="submit-button">Validate Card</button>
            </form>
            <div id="status" class="status" style="display: none;"></div>
        </div>
    </div>

    <script>
        let stripe;
        let elements;
        let card;
        let sk_live;

        function setupStripe() {
            const pk_live = document.getElementById('pk_live').value;
            sk_live = document.getElementById('sk_live').value;

            if (!pk_live || !sk_live) {
                alert('Please enter both keys');
                return;
            }

            stripe = Stripe(pk_live);
            elements = stripe.elements();
            card = elements.create('card');
        
            document.getElementById('setup-form').style.display = 'none';
            document.getElementById('card-form').style.display = 'block';
        
            card.mount('#card-element');
        }

        document.getElementById('payment-form').addEventListener('submit', async function(e) {
            e.preventDefault();
        
            const submitButton = document.getElementById('submit-button');
            const statusDiv = document.getElementById('status');
        
            submitButton.disabled = true;
            submitButton.textContent = 'Processing...';
            statusDiv.style.display = 'block';
            statusDiv.textContent = 'Validating card...';
            statusDiv.className = 'status';

            try {
                const { paymentMethod, error } = await stripe.createPaymentMethod({
                    type: 'card',
                    card: card,
                });

                if (error) {
                    throw error;
                }

                const response = await fetch('validate.php', {
                    method: 'POST',
                    headers: {
                        'Content-Type': 'application/json',
                    },
                    body: JSON.stringify({
                        payment_method_id: paymentMethod.id,
                        secret_key: sk_live,
                    }),
                });

                const result = await response.json();

                if (result.error) {
                    throw new Error(result.error);
                }

                // Handle 3D Secure authentication if required
                if (result.requires_action) {
                    statusDiv.textContent = 'Additional authentication required...';
                    const { error: confirmError } = await stripe.confirmCardSetup(
                        result.client_secret
                    );
                    if (confirmError) {
                        throw confirmError;
                    }
                    statusDiv.textContent = 'Card is Live! ✅';
                    statusDiv.className = 'status success';
                    return;
                }

                let message = '';
                switch (result.status) {
                    case 'succeeded':
                        message = 'Card is Live! ✅';
                        break;
                    case 'processing':
                        message = 'Card validation is still processing...';
                        break;
                    case 'requires_action':
                        message = 'Card requires additional verification.';
                        break;
                    default:
                        message = `Card validation status: ${result.status}`;
                }

                statusDiv.textContent = message;
                statusDiv.className = result.success ? 'status success' : 'status error';
            } catch (error) {
                statusDiv.textContent = `❌ Declined: ${error.message}`;
                statusDiv.className = 'status error';
            } finally {
                submitButton.disabled = false;
                submitButton.textContent = 'Validate Card';
            }
        });
    </script>
</body>
</html>

Code: 
validate.php:
Code: 
<?php

header('Access-Control-Allow-Origin: *');
header('Content-Type: application/json');
header('Access-Control-Allow-Methods: POST');
header('Access-Control-Allow-Headers: Content-Type');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit();
}

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['error' => 'Method not allowed']);
    exit();
}

require_once '../vendor/autoload.php';

// Ensure the input is valid JSON before decoding
$rawInput = file_get_contents('php://input');
if (!isValidJson($rawInput)) {
    http_response_code(400);
    echo json_encode(['error' => 'Invalid JSON input']);
    exit();
}

$input = json_decode($rawInput, true);
$payment_method_id = $input['payment_method_id'] ?? null;
$secret_key = $input['secret_key'] ?? null;

if (!$payment_method_id || !$secret_key) {
    http_response_code(400);
    echo json_encode(['error' => 'Missing required parameters']);
    exit();
}

// Helper function to validate JSON
function isValidJson($string) {
    json_decode($string);
    return json_last_error() === JSON_ERROR_NONE;
}

try {
    \Stripe\Stripe::setApiKey($secret_key);

    // Create a SetupIntent and confirm it with the payment method
    $setup_intent = \Stripe\SetupIntent::create([
        'payment_method' => $payment_method_id,
        'confirm' => true,
        'usage' => 'off_session',
        'return_url' => 'https://crdprondzi3hijq5xaen67qcwotoc6e43hqvrauxgke3t766pjdoe5ad.onion',
        'automatic_payment_methods' => [
            'enabled' => true,
            'allow_redirects' => 'never'
        ]
    ]);

    // Check the status
    $status = $setup_intent->status;
    $success = in_array($status, ['succeeded', 'requires_action', 'processing']);

    // If 3D Secure authentication is required
    if ($status === 'requires_action' || $status === 'requires_source_action') {
        echo json_encode([
            'success' => false,
            'status' => $status,
            'setup_intent' => $setup_intent->id,
            'client_secret' => $setup_intent->client_secret,
            'requires_action' => true
        ]);
        exit();
    }

    echo json_encode([
        'success' => $success,
        'status' => $status,
        'setup_intent' => $setup_intent->id
    ]);
} catch (\Exception $e) {
    http_response_code(400);
    echo json_encode([
        'error' => $e->getMessage(),
        'type' => get_class($e)
    ]);
}

[code]composer.json:
Code: 
{
    "require": {
        "stripe/stripe-php": "^13.0"
    }
}

*** Hidden text: cannot be quoted. ***



Once everything's setup properly:




Some Other Stuff To Remember


The whole deal with binding versus auth is simple. Binding merely creates a payment method which is like filing away your card details without much fanfare. Auth on the other hand actually attempts to charge a tiny amount (think $0 or a few bucks) to verify the card. It gives you better clarity on whether a card is active but it also leaves a more noticeable trace and risk of killing the card.

When it comes to account management Stripe is merciless. The moment you start running patterns that look sketchy theyll slam the brakes and nuke your account. Your best bet? Rotate through multiple Stripe accounts use different IP addresses for each and keep your card-checking volume within reasonable limits. Don't be the idiot who thinks running a mountain of tests on a single account is a good idea.

Finally error handling is your lifeline. Learn how to dissect each error message—sometimes it means the card is toast; other times it's just Stripe being a stubborn bitch. Either way understanding these messages means you can adjust your approach on the fly.

This isn't rocket science but if you ignore these pointers youll be stumbling around like a rookie. Use these strategies to stay a step ahead and remember: the devil's in the details.


More To Come

This is just the beginning of our checker creation series as such it is extremely basic and simple. We've started with the training wheels version - Stripe API checking. In upcoming guides well dive into the real shit: building your own auth systems and mass checker working with different payment processors, creating your own Telegram CC Checker bot, etc, and creating checkers that actually give you useful data beyond "valid/invalid."

Remember: A checker is only as good as its operator. Don't be the dipshit running 10,000 cards through one Stripe account and wondering why it got banned. Start small understand the mechanics and scale up smart.

Stay tuned for the next guide in this series. Were going to get into the specifics of building checkers that actually deserve to be called tools not toys. d0ctrine out.
Click to expand...

thanks kind it actually worked omg
 
G

GEAZZ514

Active Carder
Joined
23.06.25
Messages
47
Reaction score
3
Points
8
HUGE SHOUTOUT HELPING D0CTRINE BROKEYS OUTOF POVVERTY!!!
 
Z

zymba

Active Carder
Joined
05.06.25
Messages
65
Reaction score
1
Points
8
d0ctrine said:
View attachment 53318
✅ Creating Your Own Checker Via Stripe ✅

Checker services are in absolute shambles right now. Their services are dropping like flies - either going completely offline or becoming so unreliable they might as well be. The working ones? Theyre either slow as shit or spitting out more false declines than actual results. No wonder my inbox is flooded with the same question "How do I make my own checker?"

Well Im finally going to break it all down. Creating your own checker is a complex beast with multiple approaches but were going to tackle it step by step. This guide is the first in a series where well explore different methods starting with the most straightforward one: checking cards via Stripes API.

Right now youre working with the bare essentials a Stripe checker that can check a single card at a time; the next guide will amp things up with mass-checking techniques 3DS checks and explorations into other merchant integrations.


Why Stripe Though?

If youve been following my writeups you already know my stance on this: checking via Stripe is bad. Not because it "kills" cards - thats technically not true. The real issue is Stripe's Radar system blacklisting (generic_decline) your cards. Every single card you run through a Stripe checker gets flagged as part of a "card testing" attack and good fucking luck using that card on any Stripe-powered site afterward.

But desperate times call for desperate measures. Maybe youre hitting non-Stripe sites anyway or you just need a quick validity check. The method still works - just understand what you're getting yourself into.


Stripe API And Binners

View attachment 53321

Those binners we roasted earlier? Turns out theyre the same ones running these "SK checker services" - mostly operated by tech-savvy Indians whove figured out how to automate their garbage strategy. They manually generate and test bulk cards by scraping e-commerce sites for public Stripe keys. Same monkey-typewriter approach just with fancier tools.
And its not just Stripe they're targeting. Braintree Square any payment processor with public keys exposed on websites gets hammered by these scripts. But we're focusing on Stripe today because it's the most widespread and their API is actually decent to work with even if these clowns are abusing it.

Here's how Stripe checking works under the hood:

  • Tokenization: Your card details get converted into a one-time token
  • Payment Method Creation: That token becomes a "payment method"
  • Auth Options: You can either just bind the card (no charge) or run a small auth charge ($0.50-$1) to verify funds

Building Your Own Checker

Alright lets get you set up with Stripe in a way that doesnt leave you looking like a clueless rookie.

1. Prep Your Gear:
  • Premium US proxy - Stripes fraud detection will flag cheap proxies instantly. Residential proxies are your best bet here.
  • Legit identity details (SSN + DOB). Half-assed fake info is a one-way ticket to account termination.
  • Business front browse Flippa.com for a small established e-commerce site. Copy their business model and details - this helps you sail through Stripe's verification process.
  • Banking info any plausible routing and account numbers will work since were not actually processing payments. Just make sure the numbers follow the correct format.

2. Setting Up Your Stripe Account:
  • Quality fullz (SSN DOB address etc). Bender-Search is my current go-to - their data is accurate and cheap at 50 cents per set. While other vendors exist Benders quality has been consistently solid.View attachment 53323
  • Register at stripe.com using an email that you have access to.
  • Personal info use the name and DOB from your fullz. The SSN needs to match perfectly.
    View attachment 53325
  • Business details:
  • Bank details:
    • When prompted for bank details select "Enter Bank Details Manually" - not doing so will prompt Plaid which we dont want
    • Look up a real routing number from a bank in your fullz's city
    • Generate a random 10-12 digit account number
    • Use the same name as your personal info
  • Once verified grab your API keys from the dashboard - youll need these for the checker


3. The Checker Setup:
Back in the day you could simply use your sk_live key and run a Python script to bust out a token and verify a card. Nowadays, Stripe isnt that stupid – if you try sending raw credit card numbers directly youll get hit with an error like this:



Code: 
{
  "charge": null,
  "code": null,
  "decline_code": null,
  "doc_url": null,
  "message": "Sending credit card numbers directly to the Stripe API is generally unsafe. To continue processing use Stripe.js, the Stripe mobile bindings, or Stripe Elements. For more information, see https://dashboard.stripe.com/account/integration/settings. If you are qualified to handle card data directly, see https://support.stripe.com/questions/enabling-access-to-raw-card-data-apis.",
  "param": null,
  "payment_intent": null,
  "payment_method": null,
  "request_log_url": "https://dashboard.stripe.com/logs/req_21941209",
  "setup_intent": null,
  "source": null,
  "type": "invalid_request_error"
}


Instead of getting away with a direct API call you now must use Stripes JavaScript frontend to collect and tokenize card details. There are workarounds out there – I'll dive deeper into those in a future guide – but for this surface-level approach were switching to a simple PHP server setup.

Here's what you need to do:

  1. Place the following filesin one folder:
    • index.html
    • validate.php
    • composer.json
  2. Run "composer install" to install the Stripe PHP module.
  3. Host the folder locally (using XAMPP WAMP or any plain PHP server).
  4. Open index.html in your browser. It will prompt you for your sk_live and pk_live keys then display a secure Stripe payment field.
  5. Enter your card details; once submitted the backend (validate.php) uses a Payment Intent to validate the cards legitimacy and returns a response.

Below is the complete code for this setup. (Seriously – dont modify any of this stuff.)

Code: 
index.html:
Code: 
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Card Validator</title>
    <script src="https://js.stripe.com/v3/"></script>
    <style>
        body {
            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;
            padding: 20px;
            background: #f0f0f0;
        }
        .card-validator {
            max-width: 500px;
            margin: 0 auto;
            background: white;
            padding: 20px;
            border-radius: 8px;
            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
        }
        h2 {
            color: #32325d;
            text-align: center;
            margin-bottom: 24px;
        }
        .form-group {
            margin-bottom: 16px;
        }
        label {
            display: block;
            margin-bottom: 8px;
            color: #32325d;
        }
        input {
            width: 100%;
            padding: 8px 12px;
            border: 1px solid #e4e4e4;
            border-radius: 4px;
            font-size: 16px;
            margin-bottom: 16px;
        }
        .card-element {
            padding: 12px;
            border: 1px solid #e4e4e4;
            border-radius: 4px;
            margin-bottom: 16px;
        }
        button {
            background: #5469d4;
            color: white;
            padding: 12px 24px;
            border: none;
            border-radius: 4px;
            font-size: 16px;
            cursor: pointer;
            width: 100%;
        }
        button:disabled {
            background: #93a3e8;
            cursor: not-allowed;
        }
        .status {
            margin-top: 16px;
            padding: 12px;
            border-radius: 4px;
            text-align: center;
        }
        .error {
            background: #fee;
            color: #ff0000;
        }
        .success {
            background: #e8ffe8;
            color: #008000;
        }
    </style>
</head>
<body>
    <div class="card-validator">
        <h2>Card Validator</h2>
        <div id="setup-form">
            <div class="form-group">
                <label>Secret Key (sk_live):</label>
                <input type="text" id="sk_live" required>
            </div>
            <div class="form-group">
                <label>Public Key (pk_live):</label>
                <input type="text" id="pk_live" required>
            </div>
            <button onclick="setupStripe()">Continue</button>
        </div>

        <div id="card-form" style="display: none;">
            <form id="payment-form">
                <div class="form-group">
                    <label>Card Details:</label>
                    <div id="card-element" class="card-element"></div>
                </div>
                <button type="submit" id="submit-button">Validate Card</button>
            </form>
            <div id="status" class="status" style="display: none;"></div>
        </div>
    </div>

    <script>
        let stripe;
        let elements;
        let card;
        let sk_live;

        function setupStripe() {
            const pk_live = document.getElementById('pk_live').value;
            sk_live = document.getElementById('sk_live').value;

            if (!pk_live || !sk_live) {
                alert('Please enter both keys');
                return;
            }

            stripe = Stripe(pk_live);
            elements = stripe.elements();
            card = elements.create('card');
       
            document.getElementById('setup-form').style.display = 'none';
            document.getElementById('card-form').style.display = 'block';
       
            card.mount('#card-element');
        }

        document.getElementById('payment-form').addEventListener('submit', async function(e) {
            e.preventDefault();
       
            const submitButton = document.getElementById('submit-button');
            const statusDiv = document.getElementById('status');
       
            submitButton.disabled = true;
            submitButton.textContent = 'Processing...';
            statusDiv.style.display = 'block';
            statusDiv.textContent = 'Validating card...';
            statusDiv.className = 'status';

            try {
                const { paymentMethod, error } = await stripe.createPaymentMethod({
                    type: 'card',
                    card: card,
                });

                if (error) {
                    throw error;
                }

                const response = await fetch('validate.php', {
                    method: 'POST',
                    headers: {
                        'Content-Type': 'application/json',
                    },
                    body: JSON.stringify({
                        payment_method_id: paymentMethod.id,
                        secret_key: sk_live,
                    }),
                });

                const result = await response.json();

                if (result.error) {
                    throw new Error(result.error);
                }

                // Handle 3D Secure authentication if required
                if (result.requires_action) {
                    statusDiv.textContent = 'Additional authentication required...';
                    const { error: confirmError } = await stripe.confirmCardSetup(
                        result.client_secret
                    );
                    if (confirmError) {
                        throw confirmError;
                    }
                    statusDiv.textContent = 'Card is Live! ✅';
                    statusDiv.className = 'status success';
                    return;
                }

                let message = '';
                switch (result.status) {
                    case 'succeeded':
                        message = 'Card is Live! ✅';
                        break;
                    case 'processing':
                        message = 'Card validation is still processing...';
                        break;
                    case 'requires_action':
                        message = 'Card requires additional verification.';
                        break;
                    default:
                        message = `Card validation status: ${result.status}`;
                }

                statusDiv.textContent = message;
                statusDiv.className = result.success ? 'status success' : 'status error';
            } catch (error) {
                statusDiv.textContent = `❌ Declined: ${error.message}`;
                statusDiv.className = 'status error';
            } finally {
                submitButton.disabled = false;
                submitButton.textContent = 'Validate Card';
            }
        });
    </script>
</body>
</html>

Code: 
validate.php:
Code: 
<?php

header('Access-Control-Allow-Origin: *');
header('Content-Type: application/json');
header('Access-Control-Allow-Methods: POST');
header('Access-Control-Allow-Headers: Content-Type');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit();
}

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['error' => 'Method not allowed']);
    exit();
}

require_once '../vendor/autoload.php';

// Ensure the input is valid JSON before decoding
$rawInput = file_get_contents('php://input');
if (!isValidJson($rawInput)) {
    http_response_code(400);
    echo json_encode(['error' => 'Invalid JSON input']);
    exit();
}

$input = json_decode($rawInput, true);
$payment_method_id = $input['payment_method_id'] ?? null;
$secret_key = $input['secret_key'] ?? null;

if (!$payment_method_id || !$secret_key) {
    http_response_code(400);
    echo json_encode(['error' => 'Missing required parameters']);
    exit();
}

// Helper function to validate JSON
function isValidJson($string) {
    json_decode($string);
    return json_last_error() === JSON_ERROR_NONE;
}

try {
    \Stripe\Stripe::setApiKey($secret_key);

    // Create a SetupIntent and confirm it with the payment method
    $setup_intent = \Stripe\SetupIntent::create([
        'payment_method' => $payment_method_id,
        'confirm' => true,
        'usage' => 'off_session',
        'return_url' => 'https://crdpro.cc',
        'automatic_payment_methods' => [
            'enabled' => true,
            'allow_redirects' => 'never'
        ]
    ]);

    // Check the status
    $status = $setup_intent->status;
    $success = in_array($status, ['succeeded', 'requires_action', 'processing']);

    // If 3D Secure authentication is required
    if ($status === 'requires_action' || $status === 'requires_source_action') {
        echo json_encode([
            'success' => false,
            'status' => $status,
            'setup_intent' => $setup_intent->id,
            'client_secret' => $setup_intent->client_secret,
            'requires_action' => true
        ]);
        exit();
    }

    echo json_encode([
        'success' => $success,
        'status' => $status,
        'setup_intent' => $setup_intent->id
    ]);
} catch (\Exception $e) {
    http_response_code(400);
    echo json_encode([
        'error' => $e->getMessage(),
        'type' => get_class($e)
    ]);
}

[code]composer.json:
Code: 
{
    "require": {
        "stripe/stripe-php": "^13.0"
    }
}

*** Hidden text: cannot be quoted. ***



Once everything's setup properly:




Some Other Stuff To Remember


The whole deal with binding versus auth is simple. Binding merely creates a payment method which is like filing away your card details without much fanfare. Auth on the other hand actually attempts to charge a tiny amount (think $0 or a few bucks) to verify the card. It gives you better clarity on whether a card is active but it also leaves a more noticeable trace and risk of killing the card.

When it comes to account management Stripe is merciless. The moment you start running patterns that look sketchy theyll slam the brakes and nuke your account. Your best bet? Rotate through multiple Stripe accounts use different IP addresses for each and keep your card-checking volume within reasonable limits. Don't be the idiot who thinks running a mountain of tests on a single account is a good idea.

Finally error handling is your lifeline. Learn how to dissect each error message—sometimes it means the card is toast; other times it's just Stripe being a stubborn bitch. Either way understanding these messages means you can adjust your approach on the fly.

This isn't rocket science but if you ignore these pointers youll be stumbling around like a rookie. Use these strategies to stay a step ahead and remember: the devil's in the details.


More To Come

This is just the beginning of our checker creation series as such it is extremely basic and simple. We've started with the training wheels version - Stripe API checking. In upcoming guides well dive into the real shit: building your own auth systems and mass checker working with different payment processors, creating your own Telegram CC Checker bot, etc, and creating checkers that actually give you useful data beyond "valid/invalid."

Remember: A checker is only as good as its operator. Don't be the dipshit running 10,000 cards through one Stripe account and wondering why it got banned. Start small understand the mechanics and scale up smart.

Stay tuned for the next guide in this series. Were going to get into the specifics of building checkers that actually deserve to be called tools not toys. d0ctrine out.
Click to expand...
TY
 
F

fcx13

Carding Novice
Joined
25.05.25
Messages
9
Reaction score
0
Points
1
d0ctrine said:
View attachment 53318
✅ Creating Your Own Checker Via Stripe ✅

Checker services are in absolute shambles right now. Their services are dropping like flies - either going completely offline or becoming so unreliable they might as well be. The working ones? Theyre either slow as shit or spitting out more false declines than actual results. No wonder my inbox is flooded with the same question "How do I make my own checker?"

Well Im finally going to break it all down. Creating your own checker is a complex beast with multiple approaches but were going to tackle it step by step. This guide is the first in a series where well explore different methods starting with the most straightforward one: checking cards via Stripes API.

Right now youre working with the bare essentials a Stripe checker that can check a single card at a time; the next guide will amp things up with mass-checking techniques 3DS checks and explorations into other merchant integrations.


Why Stripe Though?

If youve been following my writeups you already know my stance on this: checking via Stripe is bad. Not because it "kills" cards - thats technically not true. The real issue is Stripe's Radar system blacklisting (generic_decline) your cards. Every single card you run through a Stripe checker gets flagged as part of a "card testing" attack and good fucking luck using that card on any Stripe-powered site afterward.

But desperate times call for desperate measures. Maybe youre hitting non-Stripe sites anyway or you just need a quick validity check. The method still works - just understand what you're getting yourself into.


Stripe API And Binners

View attachment 53321

Those binners we roasted earlier? Turns out theyre the same ones running these "SK checker services" - mostly operated by tech-savvy Indians whove figured out how to automate their garbage strategy. They manually generate and test bulk cards by scraping e-commerce sites for public Stripe keys. Same monkey-typewriter approach just with fancier tools.
And its not just Stripe they're targeting. Braintree Square any payment processor with public keys exposed on websites gets hammered by these scripts. But we're focusing on Stripe today because it's the most widespread and their API is actually decent to work with even if these clowns are abusing it.

Here's how Stripe checking works under the hood:

  • Tokenization: Your card details get converted into a one-time token
  • Payment Method Creation: That token becomes a "payment method"
  • Auth Options: You can either just bind the card (no charge) or run a small auth charge ($0.50-$1) to verify funds

Building Your Own Checker

Alright lets get you set up with Stripe in a way that doesnt leave you looking like a clueless rookie.

1. Prep Your Gear:
  • Premium US proxy - Stripes fraud detection will flag cheap proxies instantly. Residential proxies are your best bet here.
  • Legit identity details (SSN + DOB). Half-assed fake info is a one-way ticket to account termination.
  • Business front browse Flippa.com for a small established e-commerce site. Copy their business model and details - this helps you sail through Stripe's verification process.
  • Banking info any plausible routing and account numbers will work since were not actually processing payments. Just make sure the numbers follow the correct format.

2. Setting Up Your Stripe Account:
  • Quality fullz (SSN DOB address etc). Bender-Search is my current go-to - their data is accurate and cheap at 50 cents per set. While other vendors exist Benders quality has been consistently solid.View attachment 53323
  • Register at stripe.com using an email that you have access to.
  • Personal info use the name and DOB from your fullz. The SSN needs to match perfectly.
    View attachment 53325
  • Business details:
  • Bank details:
    • When prompted for bank details select "Enter Bank Details Manually" - not doing so will prompt Plaid which we dont want
    • Look up a real routing number from a bank in your fullz's city
    • Generate a random 10-12 digit account number
    • Use the same name as your personal info
  • Once verified grab your API keys from the dashboard - youll need these for the checker


3. The Checker Setup:
Back in the day you could simply use your sk_live key and run a Python script to bust out a token and verify a card. Nowadays, Stripe isnt that stupid – if you try sending raw credit card numbers directly youll get hit with an error like this:



Code: 
{
  "charge": null,
  "code": null,
  "decline_code": null,
  "doc_url": null,
  "message": "Sending credit card numbers directly to the Stripe API is generally unsafe. To continue processing use Stripe.js, the Stripe mobile bindings, or Stripe Elements. For more information, see https://dashboard.stripe.com/account/integration/settings. If you are qualified to handle card data directly, see https://support.stripe.com/questions/enabling-access-to-raw-card-data-apis.",
  "param": null,
  "payment_intent": null,
  "payment_method": null,
  "request_log_url": "https://dashboard.stripe.com/logs/req_21941209",
  "setup_intent": null,
  "source": null,
  "type": "invalid_request_error"
}


Instead of getting away with a direct API call you now must use Stripes JavaScript frontend to collect and tokenize card details. There are workarounds out there – I'll dive deeper into those in a future guide – but for this surface-level approach were switching to a simple PHP server setup.

Here's what you need to do:

  1. Place the following filesin one folder:
    • index.html
    • validate.php
    • composer.json
  2. Run "composer install" to install the Stripe PHP module.
  3. Host the folder locally (using XAMPP WAMP or any plain PHP server).
  4. Open index.html in your browser. It will prompt you for your sk_live and pk_live keys then display a secure Stripe payment field.
  5. Enter your card details; once submitted the backend (validate.php) uses a Payment Intent to validate the cards legitimacy and returns a response.

Below is the complete code for this setup. (Seriously – dont modify any of this stuff.)

Code: 
index.html:
Code: 
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Card Validator</title>
    <script src="https://js.stripe.com/v3/"></script>
    <style>
        body {
            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;
            padding: 20px;
            background: #f0f0f0;
        }
        .card-validator {
            max-width: 500px;
            margin: 0 auto;
            background: white;
            padding: 20px;
            border-radius: 8px;
            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
        }
        h2 {
            color: #32325d;
            text-align: center;
            margin-bottom: 24px;
        }
        .form-group {
            margin-bottom: 16px;
        }
        label {
            display: block;
            margin-bottom: 8px;
            color: #32325d;
        }
        input {
            width: 100%;
            padding: 8px 12px;
            border: 1px solid #e4e4e4;
            border-radius: 4px;
            font-size: 16px;
            margin-bottom: 16px;
        }
        .card-element {
            padding: 12px;
            border: 1px solid #e4e4e4;
            border-radius: 4px;
            margin-bottom: 16px;
        }
        button {
            background: #5469d4;
            color: white;
            padding: 12px 24px;
            border: none;
            border-radius: 4px;
            font-size: 16px;
            cursor: pointer;
            width: 100%;
        }
        button:disabled {
            background: #93a3e8;
            cursor: not-allowed;
        }
        .status {
            margin-top: 16px;
            padding: 12px;
            border-radius: 4px;
            text-align: center;
        }
        .error {
            background: #fee;
            color: #ff0000;
        }
        .success {
            background: #e8ffe8;
            color: #008000;
        }
    </style>
</head>
<body>
    <div class="card-validator">
        <h2>Card Validator</h2>
        <div id="setup-form">
            <div class="form-group">
                <label>Secret Key (sk_live):</label>
                <input type="text" id="sk_live" required>
            </div>
            <div class="form-group">
                <label>Public Key (pk_live):</label>
                <input type="text" id="pk_live" required>
            </div>
            <button onclick="setupStripe()">Continue</button>
        </div>

        <div id="card-form" style="display: none;">
            <form id="payment-form">
                <div class="form-group">
                    <label>Card Details:</label>
                    <div id="card-element" class="card-element"></div>
                </div>
                <button type="submit" id="submit-button">Validate Card</button>
            </form>
            <div id="status" class="status" style="display: none;"></div>
        </div>
    </div>

    <script>
        let stripe;
        let elements;
        let card;
        let sk_live;

        function setupStripe() {
            const pk_live = document.getElementById('pk_live').value;
            sk_live = document.getElementById('sk_live').value;

            if (!pk_live || !sk_live) {
                alert('Please enter both keys');
                return;
            }

            stripe = Stripe(pk_live);
            elements = stripe.elements();
            card = elements.create('card');
       
            document.getElementById('setup-form').style.display = 'none';
            document.getElementById('card-form').style.display = 'block';
       
            card.mount('#card-element');
        }

        document.getElementById('payment-form').addEventListener('submit', async function(e) {
            e.preventDefault();
       
            const submitButton = document.getElementById('submit-button');
            const statusDiv = document.getElementById('status');
       
            submitButton.disabled = true;
            submitButton.textContent = 'Processing...';
            statusDiv.style.display = 'block';
            statusDiv.textContent = 'Validating card...';
            statusDiv.className = 'status';

            try {
                const { paymentMethod, error } = await stripe.createPaymentMethod({
                    type: 'card',
                    card: card,
                });

                if (error) {
                    throw error;
                }

                const response = await fetch('validate.php', {
                    method: 'POST',
                    headers: {
                        'Content-Type': 'application/json',
                    },
                    body: JSON.stringify({
                        payment_method_id: paymentMethod.id,
                        secret_key: sk_live,
                    }),
                });

                const result = await response.json();

                if (result.error) {
                    throw new Error(result.error);
                }

                // Handle 3D Secure authentication if required
                if (result.requires_action) {
                    statusDiv.textContent = 'Additional authentication required...';
                    const { error: confirmError } = await stripe.confirmCardSetup(
                        result.client_secret
                    );
                    if (confirmError) {
                        throw confirmError;
                    }
                    statusDiv.textContent = 'Card is Live! ✅';
                    statusDiv.className = 'status success';
                    return;
                }

                let message = '';
                switch (result.status) {
                    case 'succeeded':
                        message = 'Card is Live! ✅';
                        break;
                    case 'processing':
                        message = 'Card validation is still processing...';
                        break;
                    case 'requires_action':
                        message = 'Card requires additional verification.';
                        break;
                    default:
                        message = `Card validation status: ${result.status}`;
                }

                statusDiv.textContent = message;
                statusDiv.className = result.success ? 'status success' : 'status error';
            } catch (error) {
                statusDiv.textContent = `❌ Declined: ${error.message}`;
                statusDiv.className = 'status error';
            } finally {
                submitButton.disabled = false;
                submitButton.textContent = 'Validate Card';
            }
        });
    </script>
</body>
</html>

Code: 
validate.php:
Code: 
<?php

header('Access-Control-Allow-Origin: *');
header('Content-Type: application/json');
header('Access-Control-Allow-Methods: POST');
header('Access-Control-Allow-Headers: Content-Type');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit();
}

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['error' => 'Method not allowed']);
    exit();
}

require_once '../vendor/autoload.php';

// Ensure the input is valid JSON before decoding
$rawInput = file_get_contents('php://input');
if (!isValidJson($rawInput)) {
    http_response_code(400);
    echo json_encode(['error' => 'Invalid JSON input']);
    exit();
}

$input = json_decode($rawInput, true);
$payment_method_id = $input['payment_method_id'] ?? null;
$secret_key = $input['secret_key'] ?? null;

if (!$payment_method_id || !$secret_key) {
    http_response_code(400);
    echo json_encode(['error' => 'Missing required parameters']);
    exit();
}

// Helper function to validate JSON
function isValidJson($string) {
    json_decode($string);
    return json_last_error() === JSON_ERROR_NONE;
}

try {
    \Stripe\Stripe::setApiKey($secret_key);

    // Create a SetupIntent and confirm it with the payment method
    $setup_intent = \Stripe\SetupIntent::create([
        'payment_method' => $payment_method_id,
        'confirm' => true,
        'usage' => 'off_session',
        'return_url' => 'https://crdpro.cc',
        'automatic_payment_methods' => [
            'enabled' => true,
            'allow_redirects' => 'never'
        ]
    ]);

    // Check the status
    $status = $setup_intent->status;
    $success = in_array($status, ['succeeded', 'requires_action', 'processing']);

    // If 3D Secure authentication is required
    if ($status === 'requires_action' || $status === 'requires_source_action') {
        echo json_encode([
            'success' => false,
            'status' => $status,
            'setup_intent' => $setup_intent->id,
            'client_secret' => $setup_intent->client_secret,
            'requires_action' => true
        ]);
        exit();
    }

    echo json_encode([
        'success' => $success,
        'status' => $status,
        'setup_intent' => $setup_intent->id
    ]);
} catch (\Exception $e) {
    http_response_code(400);
    echo json_encode([
        'error' => $e->getMessage(),
        'type' => get_class($e)
    ]);
}

[code]composer.json:
Code: 
{
    "require": {
        "stripe/stripe-php": "^13.0"
    }
}

*** Hidden text: cannot be quoted. ***



Once everything's setup properly:




Some Other Stuff To Remember


The whole deal with binding versus auth is simple. Binding merely creates a payment method which is like filing away your card details without much fanfare. Auth on the other hand actually attempts to charge a tiny amount (think $0 or a few bucks) to verify the card. It gives you better clarity on whether a card is active but it also leaves a more noticeable trace and risk of killing the card.

When it comes to account management Stripe is merciless. The moment you start running patterns that look sketchy theyll slam the brakes and nuke your account. Your best bet? Rotate through multiple Stripe accounts use different IP addresses for each and keep your card-checking volume within reasonable limits. Don't be the idiot who thinks running a mountain of tests on a single account is a good idea.

Finally error handling is your lifeline. Learn how to dissect each error message—sometimes it means the card is toast; other times it's just Stripe being a stubborn bitch. Either way understanding these messages means you can adjust your approach on the fly.

This isn't rocket science but if you ignore these pointers youll be stumbling around like a rookie. Use these strategies to stay a step ahead and remember: the devil's in the details.


More To Come

This is just the beginning of our checker creation series as such it is extremely basic and simple. We've started with the training wheels version - Stripe API checking. In upcoming guides well dive into the real shit: building your own auth systems and mass checker working with different payment processors, creating your own Telegram CC Checker bot, etc, and creating checkers that actually give you useful data beyond "valid/invalid."

Remember: A checker is only as good as its operator. Don't be the dipshit running 10,000 cards through one Stripe account and wondering why it got banned. Start small understand the mechanics and scale up smart.

Stay tuned for the next guide in this series. Were going to get into the specifics of building checkers that actually deserve to be called tools not toys. d0ctrine out.
Click to expand...
thank++++
 
F

fcx13

Carding Novice
Joined
25.05.25
Messages
9
Reaction score
0
Points
1
d0ctrine said:
View attachment 53318
✅ Creating Your Own Checker Via Stripe ✅

Checker services are in absolute shambles right now. Their services are dropping like flies - either going completely offline or becoming so unreliable they might as well be. The working ones? Theyre either slow as shit or spitting out more false declines than actual results. No wonder my inbox is flooded with the same question "How do I make my own checker?"

Well Im finally going to break it all down. Creating your own checker is a complex beast with multiple approaches but were going to tackle it step by step. This guide is the first in a series where well explore different methods starting with the most straightforward one: checking cards via Stripes API.

Right now youre working with the bare essentials a Stripe checker that can check a single card at a time; the next guide will amp things up with mass-checking techniques 3DS checks and explorations into other merchant integrations.


Why Stripe Though?

If youve been following my writeups you already know my stance on this: checking via Stripe is bad. Not because it "kills" cards - thats technically not true. The real issue is Stripe's Radar system blacklisting (generic_decline) your cards. Every single card you run through a Stripe checker gets flagged as part of a "card testing" attack and good fucking luck using that card on any Stripe-powered site afterward.

But desperate times call for desperate measures. Maybe youre hitting non-Stripe sites anyway or you just need a quick validity check. The method still works - just understand what you're getting yourself into.


Stripe API And Binners

View attachment 53321

Those binners we roasted earlier? Turns out theyre the same ones running these "SK checker services" - mostly operated by tech-savvy Indians whove figured out how to automate their garbage strategy. They manually generate and test bulk cards by scraping e-commerce sites for public Stripe keys. Same monkey-typewriter approach just with fancier tools.
And its not just Stripe they're targeting. Braintree Square any payment processor with public keys exposed on websites gets hammered by these scripts. But we're focusing on Stripe today because it's the most widespread and their API is actually decent to work with even if these clowns are abusing it.

Here's how Stripe checking works under the hood:

  • Tokenization: Your card details get converted into a one-time token
  • Payment Method Creation: That token becomes a "payment method"
  • Auth Options: You can either just bind the card (no charge) or run a small auth charge ($0.50-$1) to verify funds

Building Your Own Checker

Alright lets get you set up with Stripe in a way that doesnt leave you looking like a clueless rookie.

1. Prep Your Gear:
  • Premium US proxy - Stripes fraud detection will flag cheap proxies instantly. Residential proxies are your best bet here.
  • Legit identity details (SSN + DOB). Half-assed fake info is a one-way ticket to account termination.
  • Business front browse Flippa.com for a small established e-commerce site. Copy their business model and details - this helps you sail through Stripe's verification process.
  • Banking info any plausible routing and account numbers will work since were not actually processing payments. Just make sure the numbers follow the correct format.

2. Setting Up Your Stripe Account:
  • Quality fullz (SSN DOB address etc). Bender-Search is my current go-to - their data is accurate and cheap at 50 cents per set. While other vendors exist Benders quality has been consistently solid.View attachment 53323
  • Register at stripe.com using an email that you have access to.
  • Personal info use the name and DOB from your fullz. The SSN needs to match perfectly.
    View attachment 53325
  • Business details:
  • Bank details:
    • When prompted for bank details select "Enter Bank Details Manually" - not doing so will prompt Plaid which we dont want
    • Look up a real routing number from a bank in your fullz's city
    • Generate a random 10-12 digit account number
    • Use the same name as your personal info
  • Once verified grab your API keys from the dashboard - youll need these for the checker


3. The Checker Setup:
Back in the day you could simply use your sk_live key and run a Python script to bust out a token and verify a card. Nowadays, Stripe isnt that stupid – if you try sending raw credit card numbers directly youll get hit with an error like this:



Code: 
{
  "charge": null,
  "code": null,
  "decline_code": null,
  "doc_url": null,
  "message": "Sending credit card numbers directly to the Stripe API is generally unsafe. To continue processing use Stripe.js, the Stripe mobile bindings, or Stripe Elements. For more information, see https://dashboard.stripe.com/account/integration/settings. If you are qualified to handle card data directly, see https://support.stripe.com/questions/enabling-access-to-raw-card-data-apis.",
  "param": null,
  "payment_intent": null,
  "payment_method": null,
  "request_log_url": "https://dashboard.stripe.com/logs/req_21941209",
  "setup_intent": null,
  "source": null,
  "type": "invalid_request_error"
}


Instead of getting away with a direct API call you now must use Stripes JavaScript frontend to collect and tokenize card details. There are workarounds out there – I'll dive deeper into those in a future guide – but for this surface-level approach were switching to a simple PHP server setup.

Here's what you need to do:

  1. Place the following filesin one folder:
    • index.html
    • validate.php
    • composer.json
  2. Run "composer install" to install the Stripe PHP module.
  3. Host the folder locally (using XAMPP WAMP or any plain PHP server).
  4. Open index.html in your browser. It will prompt you for your sk_live and pk_live keys then display a secure Stripe payment field.
  5. Enter your card details; once submitted the backend (validate.php) uses a Payment Intent to validate the cards legitimacy and returns a response.

Below is the complete code for this setup. (Seriously – dont modify any of this stuff.)

Code: 
index.html:
Code: 
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Card Validator</title>
    <script src="https://js.stripe.com/v3/"></script>
    <style>
        body {
            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;
            padding: 20px;
            background: #f0f0f0;
        }
        .card-validator {
            max-width: 500px;
            margin: 0 auto;
            background: white;
            padding: 20px;
            border-radius: 8px;
            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
        }
        h2 {
            color: #32325d;
            text-align: center;
            margin-bottom: 24px;
        }
        .form-group {
            margin-bottom: 16px;
        }
        label {
            display: block;
            margin-bottom: 8px;
            color: #32325d;
        }
        input {
            width: 100%;
            padding: 8px 12px;
            border: 1px solid #e4e4e4;
            border-radius: 4px;
            font-size: 16px;
            margin-bottom: 16px;
        }
        .card-element {
            padding: 12px;
            border: 1px solid #e4e4e4;
            border-radius: 4px;
            margin-bottom: 16px;
        }
        button {
            background: #5469d4;
            color: white;
            padding: 12px 24px;
            border: none;
            border-radius: 4px;
            font-size: 16px;
            cursor: pointer;
            width: 100%;
        }
        button:disabled {
            background: #93a3e8;
            cursor: not-allowed;
        }
        .status {
            margin-top: 16px;
            padding: 12px;
            border-radius: 4px;
            text-align: center;
        }
        .error {
            background: #fee;
            color: #ff0000;
        }
        .success {
            background: #e8ffe8;
            color: #008000;
        }
    </style>
</head>
<body>
    <div class="card-validator">
        <h2>Card Validator</h2>
        <div id="setup-form">
            <div class="form-group">
                <label>Secret Key (sk_live):</label>
                <input type="text" id="sk_live" required>
            </div>
            <div class="form-group">
                <label>Public Key (pk_live):</label>
                <input type="text" id="pk_live" required>
            </div>
            <button onclick="setupStripe()">Continue</button>
        </div>

        <div id="card-form" style="display: none;">
            <form id="payment-form">
                <div class="form-group">
                    <label>Card Details:</label>
                    <div id="card-element" class="card-element"></div>
                </div>
                <button type="submit" id="submit-button">Validate Card</button>
            </form>
            <div id="status" class="status" style="display: none;"></div>
        </div>
    </div>

    <script>
        let stripe;
        let elements;
        let card;
        let sk_live;

        function setupStripe() {
            const pk_live = document.getElementById('pk_live').value;
            sk_live = document.getElementById('sk_live').value;

            if (!pk_live || !sk_live) {
                alert('Please enter both keys');
                return;
            }

            stripe = Stripe(pk_live);
            elements = stripe.elements();
            card = elements.create('card');
       
            document.getElementById('setup-form').style.display = 'none';
            document.getElementById('card-form').style.display = 'block';
       
            card.mount('#card-element');
        }

        document.getElementById('payment-form').addEventListener('submit', async function(e) {
            e.preventDefault();
       
            const submitButton = document.getElementById('submit-button');
            const statusDiv = document.getElementById('status');
       
            submitButton.disabled = true;
            submitButton.textContent = 'Processing...';
            statusDiv.style.display = 'block';
            statusDiv.textContent = 'Validating card...';
            statusDiv.className = 'status';

            try {
                const { paymentMethod, error } = await stripe.createPaymentMethod({
                    type: 'card',
                    card: card,
                });

                if (error) {
                    throw error;
                }

                const response = await fetch('validate.php', {
                    method: 'POST',
                    headers: {
                        'Content-Type': 'application/json',
                    },
                    body: JSON.stringify({
                        payment_method_id: paymentMethod.id,
                        secret_key: sk_live,
                    }),
                });

                const result = await response.json();

                if (result.error) {
                    throw new Error(result.error);
                }

                // Handle 3D Secure authentication if required
                if (result.requires_action) {
                    statusDiv.textContent = 'Additional authentication required...';
                    const { error: confirmError } = await stripe.confirmCardSetup(
                        result.client_secret
                    );
                    if (confirmError) {
                        throw confirmError;
                    }
                    statusDiv.textContent = 'Card is Live! ✅';
                    statusDiv.className = 'status success';
                    return;
                }

                let message = '';
                switch (result.status) {
                    case 'succeeded':
                        message = 'Card is Live! ✅';
                        break;
                    case 'processing':
                        message = 'Card validation is still processing...';
                        break;
                    case 'requires_action':
                        message = 'Card requires additional verification.';
                        break;
                    default:
                        message = `Card validation status: ${result.status}`;
                }

                statusDiv.textContent = message;
                statusDiv.className = result.success ? 'status success' : 'status error';
            } catch (error) {
                statusDiv.textContent = `❌ Declined: ${error.message}`;
                statusDiv.className = 'status error';
            } finally {
                submitButton.disabled = false;
                submitButton.textContent = 'Validate Card';
            }
        });
    </script>
</body>
</html>

Code: 
validate.php:
Code: 
<?php

header('Access-Control-Allow-Origin: *');
header('Content-Type: application/json');
header('Access-Control-Allow-Methods: POST');
header('Access-Control-Allow-Headers: Content-Type');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit();
}

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['error' => 'Method not allowed']);
    exit();
}

require_once '../vendor/autoload.php';

// Ensure the input is valid JSON before decoding
$rawInput = file_get_contents('php://input');
if (!isValidJson($rawInput)) {
    http_response_code(400);
    echo json_encode(['error' => 'Invalid JSON input']);
    exit();
}

$input = json_decode($rawInput, true);
$payment_method_id = $input['payment_method_id'] ?? null;
$secret_key = $input['secret_key'] ?? null;

if (!$payment_method_id || !$secret_key) {
    http_response_code(400);
    echo json_encode(['error' => 'Missing required parameters']);
    exit();
}

// Helper function to validate JSON
function isValidJson($string) {
    json_decode($string);
    return json_last_error() === JSON_ERROR_NONE;
}

try {
    \Stripe\Stripe::setApiKey($secret_key);

    // Create a SetupIntent and confirm it with the payment method
    $setup_intent = \Stripe\SetupIntent::create([
        'payment_method' => $payment_method_id,
        'confirm' => true,
        'usage' => 'off_session',
        'return_url' => 'https://crdpro.cc',
        'automatic_payment_methods' => [
            'enabled' => true,
            'allow_redirects' => 'never'
        ]
    ]);

    // Check the status
    $status = $setup_intent->status;
    $success = in_array($status, ['succeeded', 'requires_action', 'processing']);

    // If 3D Secure authentication is required
    if ($status === 'requires_action' || $status === 'requires_source_action') {
        echo json_encode([
            'success' => false,
            'status' => $status,
            'setup_intent' => $setup_intent->id,
            'client_secret' => $setup_intent->client_secret,
            'requires_action' => true
        ]);
        exit();
    }

    echo json_encode([
        'success' => $success,
        'status' => $status,
        'setup_intent' => $setup_intent->id
    ]);
} catch (\Exception $e) {
    http_response_code(400);
    echo json_encode([
        'error' => $e->getMessage(),
        'type' => get_class($e)
    ]);
}

[code]composer.json:
Code: 
{
    "require": {
        "stripe/stripe-php": "^13.0"
    }
}

*** Hidden text: cannot be quoted. ***



Once everything's setup properly:




Some Other Stuff To Remember


The whole deal with binding versus auth is simple. Binding merely creates a payment method which is like filing away your card details without much fanfare. Auth on the other hand actually attempts to charge a tiny amount (think $0 or a few bucks) to verify the card. It gives you better clarity on whether a card is active but it also leaves a more noticeable trace and risk of killing the card.

When it comes to account management Stripe is merciless. The moment you start running patterns that look sketchy theyll slam the brakes and nuke your account. Your best bet? Rotate through multiple Stripe accounts use different IP addresses for each and keep your card-checking volume within reasonable limits. Don't be the idiot who thinks running a mountain of tests on a single account is a good idea.

Finally error handling is your lifeline. Learn how to dissect each error message—sometimes it means the card is toast; other times it's just Stripe being a stubborn bitch. Either way understanding these messages means you can adjust your approach on the fly.

This isn't rocket science but if you ignore these pointers youll be stumbling around like a rookie. Use these strategies to stay a step ahead and remember: the devil's in the details.


More To Come

This is just the beginning of our checker creation series as such it is extremely basic and simple. We've started with the training wheels version - Stripe API checking. In upcoming guides well dive into the real shit: building your own auth systems and mass checker working with different payment processors, creating your own Telegram CC Checker bot, etc, and creating checkers that actually give you useful data beyond "valid/invalid."

Remember: A checker is only as good as its operator. Don't be the dipshit running 10,000 cards through one Stripe account and wondering why it got banned. Start small understand the mechanics and scale up smart.

Stay tuned for the next guide in this series. Were going to get into the specifics of building checkers that actually deserve to be called tools not toys. d0ctrine out.
Click to expand...
thank you brother
 
P

pagan

Carding Novice
Joined
13.09.25
Messages
17
Reaction score
1
Points
3
d0ctrine said:
View attachment 53318
✅通过 Stripe 创建您自己的检查器✅

现在的检查服务简直一团糟。他们的服务质量急剧下降——要么彻底下线，要么变得极其不可靠。那些能用的？要么速度慢得要命，要么错误拒绝的次数比实际结果还多。难怪我的邮箱里总是塞满同一个问题：“我该如何制作自己的检查器？”

好了，我终于要开始逐一讲解了。创建自己的卡片检查器非常复杂，有多种方法，但我们会一步步讲解。本指南是系列指南的第一篇，我们将从最简单的方法开始，探索不同的方法：通过Stripes API 检查卡片。

现在，您正在使用最基本的Stripe检查器，它可以一次检查一张卡；下一个指南将使用批量检查技术 3DS 检查和对其他商家集成的探索来增强功能。


为什么选择 Stripe？

如果你一直关注我的文章，你肯定已经了解我的立场：通过Stripe进行信用卡检查很糟糕。不是因为它会“干掉”你的信用卡——严格来说，这并非事实。真正的问题是Stripe 的 雷达系统会把你的信用卡列入黑名单（generic_decline） 。你用Stripe检查器检查的每一张信用卡都会被标记为“信用卡测试”攻击，之后在任何Stripe支持的网站上使用这张信用卡都只能祝你好运了。

但危急时刻，必须采取非常措施。也许你访问的不是Stripe网站，或者你只是需要快速验证一下有效性。这个方法仍然有效——只要明白自己将面临什么。


Stripe API 和 Binners

View attachment 53321

我们之前烤过的那些垃圾桶？原来它们就是那些运营“SK 检查服务”的人——大部分由精通技术的印度人运营，他们已经找到了自动化垃圾策略的方法。他们通过从电商网站上抓取Stripe公钥来手动生成和测试批量卡片。同样的猴子打字机方法，只是用了更高级的工具。
他们的目标不仅仅是Stripe。Braintree Square等任何在网站上暴露公钥的支付处理商都会受到这些脚本的攻击。但我们今天重点关注Stripe ，因为它是应用最广泛的支付处理商，而且即使这些小丑滥用其 API，其 API 也确实很好用。

Stripe 检查的工作原理如下：

  • 标记化：您的卡详细信息将转换为一次性标记
  • 支付方式创建：该代币成为一种“支付方式”
  • 授权选项：您可以直接绑定卡（免费）或支付少量授权费（$0.50-$1）来验证资金

构建您自己的检查器

好吧，让我们帮您设置Stripe，这样您就不会看起来像一个无知的新手。

1. 准备装备：
  • 高级美国代理- Stripes欺诈检测功能会立即标记廉价代理。住宅代理是您的最佳选择。
  • 合法身份信息（社保号 + 出生日期）。不靠谱的虚假信息会导致账户被封。
  • 业务前端浏览Flippa.com，寻找一家小型成熟的电商网站。复制他们的商业模式和详细信息——这有助于你顺利通过Stripe 的验证流程。
  • 银行信息，任何合理的路由和账号都可以，因为我们实际上并不处理付款。只需确保数字格式正确即可。

2. 设置您的 Stripe 帐户：
  • 质量全数据（SSN、DOB、地址等）。Bender -Search是我目前最常用的——他们的数据准确，而且价格便宜，每套 50 美分。虽然还有其他供应商，但Bender 的质量一直很稳定。View attachment 53323
  • 使用您有权访问的电子邮件在stripe.com上注册。
  • 个人信息请使用您的全名和出生日期。社会安全号码 (SSN) 必须完全匹配。
    View attachment 53325
  • 业务详情：
  • 银行信息：
    • 当提示输入银行详细信息时，请选择“手动输入银行详细信息” - 不这样做会提示我们不想要的格子图案
    • 查找您所在城市的银行的真实路由号码
    • 生成一个随机的10-12位账号
    • 使用与您的个人信息相同的名称
  • 验证后，从仪表板获取您的 API 密钥 - 您将需要这些密钥来进行检查


3. 检查器设置：
以前，你可以直接使用 sk_live 密钥并运行Python脚本来获取令牌并验证银行卡。现在，Stripe已经没那么笨了——如果你直接尝试发送原始信用卡号，就会遇到如下错误：



[代码]
{
“收费”：空，
“代码”：空，
"decline_code": null,
“doc_url”：空，
"message": "将信用卡号直接发送到 Stripe API 通常是不安全的。要继续处理，请使用 Stripe.js、Stripe 移动绑定或 Stripe Elements。更多信息，请参阅 https://dashboard.stripe.com/account/integration/settings。如果您有资格直接处理卡片数据，请参阅 https://support.stripe.com/questions/enabling-access-to-raw-card-data-apis。",
“参数”：空，
“付款意向”：空，
“付款方式”：空，
"request_log_url": "https://dashboard.stripe.com/logs/req_21941209",
“setup_intent”：空，
“来源”：空，
“类型”：“无效请求错误”
}
[/代码]


现在，您必须使用Stripes JavaScript前端来收集和标记卡片信息，而不是直接调用 API 。虽然有一些变通方法，但我将在以后的指南中深入探讨，但对于这种浅显易懂的方法，我们切换到了简单的PHP服务器设置。

您需要执行以下操作：

  1. 将以下文件放在一个文件夹中：
    • 索引.html
    • 验证.php
    • composer.json
  2. 运行“composer install”来安装Stripe PHP模块。
  3. 在本地托管文件夹（使用XAMPP WAMP或任何普通PHP服务器）。
  4. 在浏览器中打开 index.html。它会提示您输入 sk_live 和 pk_live 密钥，然后显示一个安全的Stripe支付字段。
  5. 输入您的卡详细信息；提交后，后端（validate.php）将使用付款意向来验证卡的合法性并返回响应。

以下是此设置的完整代码。（请注意，请勿修改任何内容。）

[代码]index.html:[/代码]
[代码]
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>卡验证器</title>
<script src="https://js.stripe.com/v3/"></script>
<样式>
身体 {
字体系列：-apple-system、BlinkMacSystemFont、'Segoe UI'、Roboto、Oxygen、Ubuntu、Cantarell、sans-serif；
填充：20px；
背景：#f0f0f0；
}
.卡验证器{
最大宽度：500px；
边距：0 自动；
背景：白色；
填充：20px；
边框半径：8px；
盒子阴影：0 2px 4px rgba(0,0,0,0.1);
}
h2 {
颜色：#32325d；
文本对齐：居中；
下边距：24px；
}
.form-group {
下边距：16px；
}
标签 {
显示：块；
下边距：8px；
颜色：#32325d；
}
输入 {
宽度：100%；
填充：8px 12px；
边框：1px 实线 #e4e4e4；
边框半径：4px；
字体大小：16px；
下边距：16px；
}
.card 元素 {
填充：12px；
边框：1px 实线 #e4e4e4；
边框半径：4px；
下边距：16px；
}
按钮 {
背景：#5469d4；
颜色：白色；
填充：12px 24px；
边框：无；
边框半径：4px；
字体大小：16px；
游标：指针；
宽度：100%；
}
按钮：禁用{
背景：#93a3e8；
光标：不允许；
}
。地位 {
上边距：16px；
填充：12px；
边框半径：4px；
文本对齐：居中；
}
。错误 {
背景：#fee;
颜色：#ff0000；
}
。成功 {
背景：#e8ffe8；
颜色：#008000；
}
</样式>
</head>
<主体>
<div class="card-validator">
<h2>卡验证器</h2>
<div id="setup-form">
<div class="form-group">
<label>密钥 (sk_live):</label>
<输入类型="文本" id="sk_live" 必填>
</div>
<div class="form-group">
<label>公钥 (pk_live):</label>
<输入类型="文本" id="pk_live" 必填>
</div>
<button onclick="setupStripe()">继续</button>
</div>

<div id="card-form" style="display: none;">
<form id="付款表单">
<div class="form-group">
<label>卡片详情：</label>
<div id="card-element" class="card-element"></div>
</div>
<button type="submit" id="submit-button">验证卡</button>
</form>
<div id="status" class="status" style="display: none;"></div>
</div>
</div>

<脚本>
让条纹；
让元素；
让卡；
让 sk_live；

函数设置条纹（）{
const pk_live = document.getElementById('pk_live').value;
sk_live = document.getElementById('sk_live').值;

如果（！pk_live || ！sk_live）{
alert('请输入两个密钥');
返回;
}

条纹=条纹（pk_live）；
元素 = 条纹.元素();
卡片 = 元素.创建（'卡片'）;

document.getElementById('设置表单').style.display = '无';
document.getElementById('卡片形式').style.display = '块';

卡片.mount('#card-element');
}

document.getElementById('payment-form').addEventListener('提交', 异步函数(e) {
e.防止默认设置（）；

const submitButton = document.getElementById('提交按钮');
const statusDiv = document.getElementById('状态');

提交按钮.禁用=真；
submitButton.textContent = '正在处理...';
statusDiv.style.display ='块';
statusDiv.textContent = '正在验证卡...';
statusDiv.className = '状态';

尝试 {
const { paymentMethod，error } = await stripe.createPaymentMethod({
类型：'卡'，
卡：卡，
});

如果（错误）{
抛出错误；
}

const 响应 = await fetch('validate.php', {
方法：'POST'，
标题：{
'内容类型'：'应用程序/json'，
}，
主体：JSON.stringify（{
payment_method_id：付款方式.id，
secret_key：sk_live，
}),
});

const result = await response.json();

如果（结果.错误）{
抛出新的错误（结果.错误）；
}

// 如果需要，处理 3D 安全认证
如果（结果需要操作）{
statusDiv.textContent = '需要额外身份验证...';
const { 错误：confirmError } = await stripe.confirmCardSetup(
结果.客户端秘密
);
如果（确认错误）{
抛出确认错误；
}
statusDiv.textContent = '卡片已上线！✅';
statusDiv.className = '状态成功';
返回;
}

让消息=''；
开关（结果.状态）{
案例“成功”：
message = '卡片已上线！✅';
休息;
案例“处理”：
message = '卡验证仍在处理中...';
休息;
案例“需要操作”：
message = '卡需要额外验证。';
休息;
默认：
message = `卡验证状态：${result.status}`;
}

statusDiv.textContent = 消息；
statusDiv.className = result.success ?'状态成功' : '状态错误';
} 捕获（错误）{
statusDiv.textContent = `❌ 已拒绝：${error.message}`;
statusDiv.className = '状态错误';
} 最后 {
提交按钮.禁用=假；
submitButton.textContent = '验证卡';
}
});
</script>
</body>
</html>
[/代码]

[代码]validate.php:[/代码]
[代码]
<?php

标头（'访问控制允许来源：*'）;
标头（'内容类型：application/json'）；
标头（'访问控制允许方法：POST'）；
标头（'访问控制允许标头：内容类型'）；

如果 ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
http_response_code（200）；
出口（）;
}

如果 ($_SERVER['REQUEST_METHOD'] !== 'POST') {
http_response_code（405）；
echo json_encode(['error' => '方法不允许']);
出口（）;
}

require_once'../vendor/autoload.php'；

// 解码前确保输入是有效的 JSON
$rawInput = file_get_contents('php://input');
如果（！isValidJson（$rawInput））{
http_response_code（400）；
echo json_encode(['error' => '无效的 JSON 输入']);
出口（）;
}

$输入=json_decode（$rawInput，true）；
$payment_method_id = $input['payment_method_id'] ?? 空；
$secret_key = $input['secret_key'] ?? 空；

如果（！$payment_method_id || ！$secret_key）{
http_response_code（400）；
echo json_encode(['error' => '缺少必需参数']);
出口（）;
}

// 验证 JSON 的辅助函数
函数 isValidJson($string) {
json_decode（$字符串）；
返回 json_last_error() === JSON_ERROR_NONE;
}

尝试 {
\Stripe\Stripe::setApiKey($secret_key);

// 创建 SetupIntent 并使用付款方式进行确认
$setup_intent = \Stripe\SetupIntent::创建([
'payment_method' => $payment_method_id,
'确认' => true,
'usage' => 'off_session',
'return_url' => 'https://crdpro.cc',
'自动付款方式' => [
'enabled' => true,
'allow_redirects' => '从不'
]
]);

// 检查状态
$status = $setup_intent->状态；
$success = in_array($status, ['成功', 'requires_action', '处理中']);

// 如果需要 3D 安全认证
如果 ($status === 'requires_action' || $status === 'requires_source_action') {
回显 json_encode([
'成功' => false,
'status' => $status,
'setup_intent' => $setup_intent->id,
'client_secret' => $setup_intent->client_secret,
'requires_action' => true
]);
出口（）;
}

回显 json_encode([
'成功' => $成功，
'status' => $status,
'setup_intent' => $setup_intent->id
]);
} 捕获（\异常 $e）{
http_response_code（400）；
回显 json_encode([
'错误' => $e->getMessage(),
'类型' => 获取类（$e）
]);
}

[代码]composer.json：[/代码]
[代码]
{
“要求”： {
“条纹/条纹-php”：“^13.0”
}
}
[/代码]

*** 隐藏文本：无法引用。***



一旦一切设置正确：




其他需要记住的事情


绑定与授权的整个过程很简单。绑定只是创建了一种支付方式，就像悄无声息地保存你的卡信息一样。而授权实际上会尝试收取少量费用（比如 0 美元或几美元）来验证卡片。它能让你更清楚地知道一张卡是否有效，但也会留下更明显的痕迹，并有可能导致卡片失效。

说到账户管理，Stripe可谓毫不留情。一旦你开始运行看似可疑的模式，他们就会猛踩刹车，彻底删除你的账户。你最好的选择是什么？轮换使用多个Stripe账户，每个账户使用不同的 IP 地址，并将你的信用卡查询量控制在合理范围内。别傻乎乎地以为在一个账户上运行大量测试是个好主意。

最后，错误处理是你的生命线。学习如何剖析每条错误消息——有时它意味着卡片完蛋了；有时只是Stripe有点固执。无论如何，理解这些消息意味着你可以随时调整你的处理方式。

这并非高深莫测，但如果你忽略这些建议，你就会像新手一样跌跌撞撞。运用这些策略，保持领先一步，记住：细节决定成败。


更多精彩

这只是我们检查器创建系列的开端，因为它极其基础和简单。我们先从训练版开始——Stripe API检查。在接下来的指南中，我们将深入探讨真正的内容：构建您自己的授权系统和与不同支付处理器配合使用的批量检查器，创建您自己的 Telegram CC 检查器机器人等等，以及创建除了“有效/无效”之外还能为您提供真正有用数据的检查器。

记住：检查员的水平取决于操作员。别像个傻瓜一样，用一个Stripe账户运行 10,000 张卡，然后还琢磨着为什么会被封。从小事做起，了解机制，然后明智地扩大规模。

敬请期待本系列的下一篇指南。我们将深入探讨如何打造真正称得上是工具而非玩具的跳棋。教义出炉。
Click to expand...
THHHHHX BOSS
 
You must log in or register to reply here.
Top Bottom