Any javascript expert please help me figure out how google generate ktl/bgresponse key?

[DreamBigWorkHard]

Hey guys,

Trying to do some trick on gmail signup page(https://accounts.google.com/SignUp?service=mail&continue=http://mail.google.com/mail/&ltmpl=default). And I've noticed there're two hidden input element(ktl and bgresponse), which are dynamically generated by your input content(e.g. first name/last name, etc.). I'm not very familiar with javascript, so would anybody please check it out and walk me through how the codes are generated?

Thanks a lot

 

[hatemachine]

And why would anyone reveal that to you? How many public gmail account creators are there? Zero. That's because no one, or only some know how to generate those values. So you won't find anyone.

 

[DreamBigWorkHard]

And why would anyone reveal that to you? How many public gmail account creators are there? Zero. That's because no one, or only some know how to generate those values. So you won't find anyone.

wow, this is encouraging?

 

[hatemachine]

wow, this is encouraging...

It's the truth, the earlier you accept it the less time you'll waste on it. So I just saved you many days, use a browser to automate it.

 

[DreamBigWorkHard]

It's the truth, the earlier you accept it the less time you'll waste on it. So I just saved you many days, use a browser to automate it.

well, you know, browser's way too slow and clumsy?

You think there's a chance some expert would give you some hints if you tell them you just want to build some web apps as great as gmail? Looks like people here dont want to reveal a single bit? i mean it wouldn't hurt if somebody can give some output just on the security's point of view?

 

[hatemachine]

well, you know, browser's way too slow and clumsy...

You think there's a chance some expert would give you some hints if you tell them you just want to build some web apps as great as gmail? Looks like people here dont want to reveal a single bit... i mean it wouldn't hurt if somebody can give some output just on the security's point of view...

A slow account creator is still better than none at all. The KTL value is generated based on the user input, things like typing speed are being taken in consideration and more. Even then, there is the SMS verification which can still occur even on manually created accounts.

 

[DreamBigWorkHard]

A slow account creator is still better than none at all. The KTL value is generated based on the user input, things like typing speed are being taken in consideration and more. Even then, there is the SMS verification which can still occur even on manually created accounts.

yeah, from my observation ktl is encoded by the input of several fields, and even backspace is captured as well, just dont know how they encode stuff. They didn't hide anything in the source though.

 

[sam.hunt0710]

They generate it with a js which is downloaded with the first http request you make.

Your best bet would be to use a JS compiler or rendering engine which can compile and spit js output like a headless browser, if you dont want to go the browser automation route.

Yes its possible to do without browser automation.

Good luck, this is not a project for the faint hearted

 

[DreamBigWorkHard]

They generate it with a js which is downloaded with the first http request you make.

Your best bet would be to use a JS compiler or rendering engine which can compile and spit js output like a headless browser, if you dont want to go the browser automation route.

Yes its possible to do without browser automation.

Good luck, this is not a project for the faint hearted

Are you sure? Cuz i don't see any js request other than analytics or InputValidator or captcha request. Would you elaborate a bit more?

 

[sam.hunt0710]

Are you sure? Cuz i don't see any js request other than analytics or InputValidator or captcha request. Would you elaborate a bit more?

I will tinker a bit tomorrow and let you know the exact js which does it. Only way to do it is via a js on the client site.

 

[DreamBigWorkHard]

I will tinker a bit tomorrow and let you know the exact js which does it. Only way to do it is via a js on the client site.

Nice. Can't wait to learn something new