Server-Request has to look like Client-Request

Collapse
This topic is closed.
X
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • Cord-Heinrich Pahlmann
    #1

    Server-Request has to look like Client-Request

    Hi,

    I wrote a script which reads a formular from a forum loginpage. It
    automatically fills in my credentials an logs me in when I hit submit.
    I have secured the path to the script with a .htaccess file.

    I have now a problem with one site which generates some kind of
    checkcode. The checkcode is placed in a hidden input field.
    I read the remote page with the "file(url)" command an parse it with
    PHP to a new formular with my credentials.
    When the server gets the formular with the file-command he gets a
    different checkcode as if I surf to the remote site with my browser.
    The checkcode looks like a md5-Hash an probably takes the ip to confirm
    the sender.
    Is ist possible for PHP to take my client-ip an sent it to the
    remote-server so I get an approveable checkcode when sending the
    generated formular?

    Thanks for any answers and suggestions.

    Tags: None
    • seaside
      #2
      Re: Server-Request has to look like Client-Request


      Cord-Heinrich Pahlmann schrieb:
      Hi,
      >
      I wrote a script which reads a formular from a forum loginpage. It
      automatically fills in my credentials an logs me in when I hit submit.
      I have secured the path to the script with a .htaccess file.
      >
      I have now a problem with one site which generates some kind of
      checkcode. The checkcode is placed in a hidden input field.
      I read the remote page with the "file(url)" command an parse it with
      PHP to a new formular with my credentials.
      When the server gets the formular with the file-command he gets a
      different checkcode as if I surf to the remote site with my browser.
      The checkcode looks like a md5-Hash an probably takes the ip to confirm
      the sender.
      Is ist possible for PHP to take my client-ip an sent it to the
      remote-server so I get an approveable checkcode when sending the
      generated formular?
      I'm not complete sure, what you are looking for.

      Would like to take another (the client IP received from the HTTP
      request of the initial form) and pass it to the remote form as if it
      would be your PHP server's IP?

      You might forward any IP in your HTTP body data, but changing
      (spoofing) your request IP is beyond PHPs capabilities.

      Hopefully, this help. HM, not sure...

        Comment

        • Gordon Burditt
          #3
          Re: Server-Request has to look like Client-Request

          >I wrote a script which reads a formular from a forum loginpage. It
          >automaticall y fills in my credentials an logs me in when I hit submit.
          >I have secured the path to the script with a .htaccess file.
          >I have now a problem with one site which generates some kind of
          >checkcode. The checkcode is placed in a hidden input field.
          >I read the remote page with the "file(url)" command an parse it with
          >PHP to a new formular with my credentials.
          Presumably this is done to stop you from doing automatic logins,
          or session stealing by sniffing traffic.
          >When the server gets the formular with the file-command he gets a
          >different checkcode as if I surf to the remote site with my browser.
          If the server fetches the page, parses out the code, and sends it
          back, it should be the correct code, unless there's javascript or
          something on the page to compute a code.
          >The checkcode looks like a md5-Hash an probably takes the ip to confirm
          >the sender.
          The hash MIGHT be a md5 Hash of a secret string, your IP address,
          and some other stuff (like your browser ID string, session ID,
          random numbers generated and saved server-side or whatever). You
          probably can't reverse-engineer this without knowing the secret
          string and other details about how it is computed.

          Unless you set up a proxy, you can't easily fake what IP your
          connection is coming from. If your intent is for the server to
          submit the login page and your browser to submit subsequent pages
          directly, it won't work if it's doing a simple IP check.
          >Is ist possible for PHP to take my client-ip an sent it to the
          >remote-server so I get an approveable checkcode when sending the
          >generated formular?
          Fetch the page, parse out the code, and return it. Then proxy all
          subsequent requests.

            Comment

            • Peter Fox
              #4
              Re: Server-Request has to look like Client-Request

              Following on from Cord-Heinrich Pahlmann's message. . .

              Err... Please do tell us why you don't ask the original web site
              owner....
              .... Oh I see you're trying to spam or rip the site - silly me. DIAF
              >Hi,
              >
              >I wrote a script which reads a formular from a forum loginpage. It
              >automaticall y fills in my credentials an logs me in when I hit submit.
              >I have secured the path to the script with a .htaccess file.
              >
              >I have now a problem with one site which generates some kind of
              >checkcode. The checkcode is placed in a hidden input field.
              >I read the remote page with the "file(url)" command an parse it with
              >PHP to a new formular with my credentials.
              >When the server gets the formular with the file-command he gets a
              >different checkcode as if I surf to the remote site with my browser.
              >The checkcode looks like a md5-Hash an probably takes the ip to confirm
              >the sender.
              >Is ist possible for PHP to take my client-ip an sent it to the
              >remote-server so I get an approveable checkcode when sending the
              >generated formular?
              >
              >Thanks for any answers and suggestions.
              >
              --
              PETER FOX Not the same since the statuette business went bust
              peterfox@eminen t.demon.co.uk.n ot.this.bit.no. html
              2 Tees Close, Witham, Essex.
              Gravity beer in Essex <http://www.eminent.dem on.co.uk>

                Comment

                • seaside
                  #5
                  Re: Server-Request has to look like Client-Request


                  Peter Fox schrieb:
                  Following on from Cord-Heinrich Pahlmann's message. . .
                  >
                  Err... Please do tell us why you don't ask the original web site
                  owner....
                  ... Oh I see you're trying to spam or rip the site - silly me. DIAF
                  Same thoughts here...

                    Comment

                    • Cord-Heinrich Pahlmann
                      #6
                      Re: Server-Request has to look like Client-Request


                      seaside schrieb:
                      Peter Fox schrieb:
                      >
                      Following on from Cord-Heinrich Pahlmann's message. . .

                      Err... Please do tell us why you don't ask the original web site
                      owner....
                      ... Oh I see you're trying to spam or rip the site - silly me. DIAF
                      >
                      Same thoughts here...
                      I can understand that you would think that I have bad intentions, but I
                      wouldn't give away my real name if I had bad ones. Right?

                        Comment

                        • Peter Fox
                          #7
                          Re: Server-Request has to look like Client-Request

                          Following on from Cord-Heinrich Pahlmann's message. . .
                          >
                          >seaside schrieb:
                          >
                          >Peter Fox schrieb:
                          >>
                          Following on from Cord-Heinrich Pahlmann's message. . .
                          >
                          Err... Please do tell us why you don't ask the original web site
                          owner....
                          ... Oh I see you're trying to spam or rip the site - silly me. DIAF
                          >>
                          >Same thoughts here...
                          >
                          >I can understand that you would think that I have bad intentions, but I
                          >wouldn't give away my real name if I had bad ones. Right?
                          >
                          And the answer to my question is....
                          --
                          PETER FOX Not the same since the porcelain business went down the pan
                          peterfox@eminen t.demon.co.uk.n ot.this.bit.no. html
                          2 Tees Close, Witham, Essex.
                          Gravity beer in Essex <http://www.eminent.dem on.co.uk>

                            Comment

                            Previous template Next
                            Working...