Anyone that solves this is AMAZING (JS regex)

JesusBack

JesusBack

BANNED
Joined
Sep 15, 2010
Messages
1,072
Reaction score
1,303
http://members.virtualtourist.com/m/j/

they have some javascript random number as their captcha but I haven't been able to get it.

If someone manages to get it I'll add it to the free bot I have already here.
 
Advertise on BHW
arbydee2 said:
It calls 3 js

http://cache.virtualtourist.com/js/MP1.1.7_all.js
http://members.virtualtourist.com/dwr/engine.js
http://members.virtualtourist.com/dwr/interface/AjaxServlet.js

I'm guessing the captcha/random numbers is coming from one of those. I'll take a closer look later.
Click to expand...
okay that's awesome if you look into it.
 
JesusBack said:
your browser is updating in live time for some reason my browser and curl won't do that.
Click to expand...

Browsers, e.g., Firefox, do not always display the entire source when viewing page source. Similarly, when you save source that you are viewing, you may not get the entire page source. This can cause you to chase your tail until you figure out this 'feature'.

Curl will get the entire source. Just run it from the command line and save source to a file. Edit/view the file, and you should see all the JS, including the included js files.

I've done a good bit of research on the subject, and Python + javascript for this purpose is a tough nut to crack.

If you haven't done so already, you really ought to check out Selenium. It gives you full access to the javascript in a page and even offers a debugger-like interface so you can inspect/change variables. You can even insert javascript code in to the DOM. The icing on the cake is that you can drive it from the command line, making it pretty cool for web automation tasks.

--Ma
 
JesusBack said:
edit: I'm being told python can via beautiful soap or something.
Click to expand...

It's BeautifulSoup. Don't blame me, I didn't name it.

BeautifulSoup is THE tool for HTML and XML parsing. It really shines when working with mal-formed source.

Python + BeautifulSoup make an awesome web automation platform.

However, BeautifulSoup doesn't do javascript.

--Ma
 
MaDeuce said:
Browsers, e.g., Firefox, do not always display the entire source when viewing page source. Similarly, when you save source that you are viewing, you may not get the entire page source. This can cause you to chase your tail until you figure out this 'feature'.

Curl will get the entire source. Just run it from the command line and save source to a file. Edit/view the file, and you should see all the JS, including the included js files.

I've done a good bit of research on the subject, and Python + javascript for this purpose is a tough nut to crack.

If you haven't done so already, you really ought to check out Selenium. It gives you full access to the javascript in a page and even offers a debugger-like interface so you can inspect/change variables. You can even insert javascript code in to the DOM. The icing on the cake is that you can drive it from the command line, making it pretty cool for web automation tasks.

--Ma
Click to expand...
I don't have a problem getting the source, I just can't track down where the JS is updating the the span with a random number...
 
$$Money$$ said:
Not by itself no. but there are ways of parsing javascript in python. Anything a browser can do, you can do it in python.
Click to expand...

Agreed, python is a turing machine, so... I don't want to hijack the thread, but what are you suggesting? I haven't come across any combo of things that are really usable off-the-shelf. Jython/Rhino aren't complete (e.g., you can execute js within python, but you can't call a function defined in js from python, etc.). Python-spidermonkey is a work-in-process as well. If something exists that really gives full access to js from within python, it would quickly become a part of my toolkit. If you know of something and share it, it would make my weekend. thanks.

--Ma
 
JesusBack said:
I don't have a problem getting the source, I just can't track down where the JS is updating the the span with a random number...
Click to expand...

Ah, I see. Get the Venkman javascript debugger for FF. Load the page. Set a breakpoint on the js function that does the randomization. When you hit the breakpoint, look at the backtrace. It will at least show you how the function got called.

--Ma
 
MaDeuce said:
Ah, I see. Get the Venkman javascript debugger for FF. Load the page. Set a breakpoint on the js function that does the randomization. When you hit the breakpoint, look at the backtrace. It will at least show you how the function got called.

--Ma
Click to expand...
thanks I will try but I had no luck with firebug I guess I'll try this.
 
roachZ said:
Just get the span content "cu".
Click to expand...
it updates automatically in a normal browser but if taken with curl or urllib it'll get the full source where it doesn't parse js.
 
this is nice nerdy talk...sure wish i knew what yall were saying...i guess i gotta get back to work...btw Madeuce are u a woman??...if so...that is sooo sexy u know this shit
 
Looked at all the source codes and all I could find that could possibly be what's incorporating what you're talking about could be this chunk of code from engine.js:

Code: 
/** The original page id sent from the server */
dwr.engine._origScriptSessionId = "E38EB46A656C70C10825E26A6092F8A0";

/** The session cookie name */
dwr.engine._sessionCookieName = "JSESSIONID"; // JSESSIONID

/** Is GET enabled for the benefit of Safari? */
dwr.engine._allowGetForSafariButMakeForgeryEasier = "false";

/** The script prefix to strip in the case of scriptTagProtection. */
dwr.engine._scriptTagProtection = "throw 'allowScriptTagRemoting is false.';";

/** The default path to the DWR servlet */
dwr.engine._defaultPath = "/dwr";

/** The read page id that we calculate */
dwr.engine._scriptSessionId = null;

/** The function that we use to fetch/calculate a session id */
dwr.engine._getScriptSessionId = function() {
  if (dwr.engine._scriptSessionId == null) {
    dwr.engine._scriptSessionId = dwr.engine._origScriptSessionId + Math.floor(Math.random() * 1000);
  }
  return dwr.engine._scriptSessionId;
};

They hardcoded E38EB46A656C70C10825E26A6092F8A0 as the id and then they add a random number to it here:

dwr.engine._scriptSessionId = dwr.engine._origScriptSessionId + Math.floor(Math.random() * 1000);


Not sure if this is it, though.
 
Here it is.

On line 376 of MP1.1.7_all.js you'll see this:
Code: 
$D.ready(function(){if($B.hasClass("legacySignUp")){var a=$("input[name='sow']").val();$("#cu").html(parseInt(a,16))}});

It's taking the value of <input name="sow" and using parseInt() to return an integer (the captcha) from that hex string.
 
Grizzy said:
Here it is.

On line 376 of MP1.1.7_all.js you'll see this:
Code: 
$D.ready(function(){if($B.hasClass("legacySignUp")){var a=$("input[name='sow']").val();$("#cu").html(parseInt(a,16))}});

It's taking the value of <input name="sow" and using parseInt() to return an integer (the captcha) from that hex string.
Click to expand...

Good job man, that's it. However, that "sow" field is a hidden field on the page and it changes every time the page refreshes. So we would also need to figure out where that "sow" value is coming from. Or I suppose it could be just fetched from the page?
 
<input type=hidden name="sow" value="17515">
Please Enter this number 95509
I don't see how they're getting 95509 out of 1715 lol...
what a weird formula
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top