Anyone that solves this is AMAZING (JS regex)
- Thread starter JesusBack
- Start date
arbydee2
Regular Member
- Mar 20, 2010
- 413
- 226
It calls 3 js
http://cache.virtualtourist.com/js/MP1.1.7_all.js
http://members.virtualtourist.com/dwr/engine.js
http://members.virtualtourist.com/dwr/interface/AjaxServlet.js
I'm guessing the captcha/random numbers is coming from one of those. I'll take a closer look later.
http://cache.virtualtourist.com/js/MP1.1.7_all.js
http://members.virtualtourist.com/dwr/engine.js
http://members.virtualtourist.com/dwr/interface/AjaxServlet.js
I'm guessing the captcha/random numbers is coming from one of those. I'll take a closer look later.
JesusBack
BANNED
- Sep 15, 2010
- 1,072
- 1,303
okay that's awesome if you look into it.
arbydee2
Regular Member
- Mar 20, 2010
- 413
- 226
Because the numbers aren't showing in the source code.
JesusBack
BANNED
- Sep 15, 2010
- 1,072
- 1,303
your browser is updating in live time for some reason my browser and curl won't do that.
JesusBack
BANNED
- Sep 15, 2010
- 1,072
- 1,303
edit: I'm being told python can via beautiful soap or something.
Browsers, e.g., Firefox, do not always display the entire source when viewing page source. Similarly, when you save source that you are viewing, you may not get the entire page source. This can cause you to chase your tail until you figure out this 'feature'.
Curl will get the entire source. Just run it from the command line and save source to a file. Edit/view the file, and you should see all the JS, including the included js files.
I've done a good bit of research on the subject, and Python + javascript for this purpose is a tough nut to crack.
If you haven't done so already, you really ought to check out Selenium. It gives you full access to the javascript in a page and even offers a debugger-like interface so you can inspect/change variables. You can even insert javascript code in to the DOM. The icing on the cake is that you can drive it from the command line, making it pretty cool for web automation tasks.
--Ma
It's BeautifulSoup. Don't blame me, I didn't name it.
BeautifulSoup is THE tool for HTML and XML parsing. It really shines when working with mal-formed source.
Python + BeautifulSoup make an awesome web automation platform.
However, BeautifulSoup doesn't do javascript.
--Ma
JesusBack
BANNED
- Sep 15, 2010
- 1,072
- 1,303
I don't have a problem getting the source, I just can't track down where the JS is updating the the span with a random number...
Agreed, python is a turing machine, so... I don't want to hijack the thread, but what are you suggesting? I haven't come across any combo of things that are really usable off-the-shelf. Jython/Rhino aren't complete (e.g., you can execute js within python, but you can't call a function defined in js from python, etc.). Python-spidermonkey is a work-in-process as well. If something exists that really gives full access to js from within python, it would quickly become a part of my toolkit. If you know of something and share it, it would make my weekend. thanks.
--Ma
Ah, I see. Get the Venkman javascript debugger for FF. Load the page. Set a breakpoint on the js function that does the randomization. When you hit the breakpoint, look at the backtrace. It will at least show you how the function got called.
--Ma
JesusBack
BANNED
- Sep 15, 2010
- 1,072
- 1,303
thanks I will try but I had no luck with firebug I guess I'll try this.
JesusBack
BANNED
- Sep 15, 2010
- 1,072
- 1,303
it updates automatically in a normal browser but if taken with curl or urllib it'll get the full source where it doesn't parse js.
boo blizzi
Regular Member
- May 28, 2009
- 365
- 297
this is nice nerdy talk...sure wish i knew what yall were saying...i guess i gotta get back to work...btw Madeuce are u a woman??...if so...that is sooo sexy u know this shit
Donnie Darko
Regular Member
- Aug 22, 2007
- 229
- 361
Looked at all the source codes and all I could find that could possibly be what's incorporating what you're talking about could be this chunk of code from engine.js:
They hardcoded E38EB46A656C70C10825E26A6092F8A0 as the id and then they add a random number to it here:
dwr.engine._scriptSessionId = dwr.engine._origScriptSessionId + Math.floor(Math.random() * 1000);
Not sure if this is it, though.
Code:
/** The original page id sent from the server */
dwr.engine._origScriptSessionId = "E38EB46A656C70C10825E26A6092F8A0";
/** The session cookie name */
dwr.engine._sessionCookieName = "JSESSIONID"; // JSESSIONID
/** Is GET enabled for the benefit of Safari? */
dwr.engine._allowGetForSafariButMakeForgeryEasier = "false";
/** The script prefix to strip in the case of scriptTagProtection. */
dwr.engine._scriptTagProtection = "throw 'allowScriptTagRemoting is false.';";
/** The default path to the DWR servlet */
dwr.engine._defaultPath = "/dwr";
/** The read page id that we calculate */
dwr.engine._scriptSessionId = null;
/** The function that we use to fetch/calculate a session id */
dwr.engine._getScriptSessionId = function() {
if (dwr.engine._scriptSessionId == null) {
dwr.engine._scriptSessionId = dwr.engine._origScriptSessionId + Math.floor(Math.random() * 1000);
}
return dwr.engine._scriptSessionId;
};They hardcoded E38EB46A656C70C10825E26A6092F8A0 as the id and then they add a random number to it here:
dwr.engine._scriptSessionId = dwr.engine._origScriptSessionId + Math.floor(Math.random() * 1000);
Not sure if this is it, though.
Grizzy
Senior Member
- Nov 11, 2008
- 920
- 1,005
Here it is.
On line 376 of MP1.1.7_all.js you'll see this:
It's taking the value of <input name="sow" and using parseInt() to return an integer (the captcha) from that hex string.
On line 376 of MP1.1.7_all.js you'll see this:
Code:
$D.ready(function(){if($B.hasClass("legacySignUp")){var a=$("input[name='sow']").val();$("#cu").html(parseInt(a,16))}});It's taking the value of <input name="sow" and using parseInt() to return an integer (the captcha) from that hex string.
Donnie Darko
Regular Member
- Aug 22, 2007
- 229
- 361
Good job man, that's it. However, that "sow" field is a hidden field on the page and it changes every time the page refreshes. So we would also need to figure out where that "sow" value is coming from. Or I suppose it could be just fetched from the page?
Grizzy
Senior Member
- Nov 11, 2008
- 920
- 1,005
