Any javascript expert please help me figure out how google generate ktl/bgresponse key?

DreamBigWorkHard · May 26, 2013

Hey guys,

Trying to do some trick on gmail signup page(https://accounts.google.com/SignUp?service=mail&continue=http://mail.google.com/mail/&ltmpl=default). And I've noticed there're two hidden input element(ktl and bgresponse), which are dynamically generated by your input content(e.g. first name/last name, etc.). I'm not very familiar with javascript, so would anybody please check it out and walk me through how the codes are generated?

Thanks a lot

hatemachine · May 26, 2013

And why would anyone reveal that to you? How many public gmail account creators are there? Zero. That's because no one, or only some know how to generate those values. So you won't find anyone.

DreamBigWorkHard · May 26, 2013

hatemachine said:
And why would anyone reveal that to you? How many public gmail account creators are there? Zero. That's because no one, or only some know how to generate those values. So you won't find anyone.

wow, this is encouraging?

hatemachine · May 26, 2013

DreamBigWorkHard said:
wow, this is encouraging...

It's the truth, the earlier you accept it the less time you'll waste on it. So I just saved you many days, use a browser to automate it.

DreamBigWorkHard · May 26, 2013

hatemachine said:
It's the truth, the earlier you accept it the less time you'll waste on it. So I just saved you many days, use a browser to automate it.

well, you know, browser's way too slow and clumsy?

You think there's a chance some expert would give you some hints if you tell them you just want to build some web apps as great as gmail? Looks like people here dont want to reveal a single bit? i mean it wouldn't hurt if somebody can give some output just on the security's point of view?

hatemachine · May 26, 2013

DreamBigWorkHard said:
well, you know, browser's way too slow and clumsy...

You think there's a chance some expert would give you some hints if you tell them you just want to build some web apps as great as gmail? Looks like people here dont want to reveal a single bit... i mean it wouldn't hurt if somebody can give some output just on the security's point of view...

A slow account creator is still better than none at all. The KTL value is generated based on the user input, things like typing speed are being taken in consideration and more. Even then, there is the SMS verification which can still occur even on manually created accounts.

DreamBigWorkHard · May 26, 2013

hatemachine said:
A slow account creator is still better than none at all. The KTL value is generated based on the user input, things like typing speed are being taken in consideration and more. Even then, there is the SMS verification which can still occur even on manually created accounts.

yeah, from my observation ktl is encoded by the input of several fields, and even backspace is captured as well, just dont know how they encode stuff. They didn't hide anything in the source though.

sam.hunt0710 · May 26, 2013

They generate it with a js which is downloaded with the first http request you make.

Your best bet would be to use a JS compiler or rendering engine which can compile and spit js output like a headless browser, if you dont want to go the browser automation route.

Yes its possible to do without browser automation.

Good luck, this is not a project for the faint hearted

DreamBigWorkHard · May 26, 2013

indianbill007 said:
They generate it with a js which is downloaded with the first http request you make.

Your best bet would be to use a JS compiler or rendering engine which can compile and spit js output like a headless browser, if you dont want to go the browser automation route.

Yes its possible to do without browser automation.

Good luck, this is not a project for the faint hearted

Are you sure? Cuz i don't see any js request other than analytics or InputValidator or captcha request. Would you elaborate a bit more?

sam.hunt0710 · May 26, 2013

DreamBigWorkHard said:
Are you sure? Cuz i don't see any js request other than analytics or InputValidator or captcha request. Would you elaborate a bit more?

I will tinker a bit tomorrow and let you know the exact js which does it. Only way to do it is via a js on the client site.

DreamBigWorkHard · May 27, 2013

indianbill007 said:
I will tinker a bit tomorrow and let you know the exact js which does it. Only way to do it is via a js on the client site.

Nice. Can't wait to learn something new

Any javascript expert please help me figure out how google generate ktl/bgresponse key?

DreamBigWorkHard

Registered Member

hatemachine

Regular Member

DreamBigWorkHard

Registered Member

hatemachine

Regular Member

DreamBigWorkHard

Registered Member

hatemachine

Regular Member

DreamBigWorkHard

Registered Member

sam.hunt0710

Elite Member

DreamBigWorkHard

Registered Member

sam.hunt0710

Elite Member

DreamBigWorkHard

Registered Member

Main Menu

Marketplace

Making Money

BlackHat World