HttpWebRequest failed to login onto web site

what is my name

  • free6

    Votes: 0 0.0%
  • everything

    Votes: 0 0.0%

  • Total voters
    0

Free6

Newbie
Joined
Nov 21, 2016
Messages
47
Reaction score
1
Hi, please guys I really need help please.

I'm trying to login onto a web site using HttpWebRequest but it's seems like it doesn't work.
When I make Request, it's just bring me to the login page (see last picture) without doing anything.

I'm using Live Http headers as well to capture HTTP traffic.

I'm currently watching this video (
)

Just want to point out that on the video, he says to use "Referer" but in "Live Http Headers" I don't see "Referer" after "Content-Length: x" that's why I use "auth_key"

Below is my code and my screen capture from Live Http Headers.

Code:
Imports System.Net
Imports System.Text
Imports System.IO

Public Class Form1

    Dim logincookie As CookieContainer

    Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click

        Dim postData As String = "auth_key=880ea6a14ea49e853634fbdc5015a024&rememberMe=1&referer=http%3A%2F%2Fforums.zybez.net%2F&ips_username=" & TextBox1.Text & "&ips_password=" & TextBox2.Text & "&submit=Login"
        Dim tempCookies As New CookieContainer
        Dim encoding As New UTF8Encoding
        Dim byteData As Byte() = encoding.GetBytes(postData)

        Dim postReq As HttpWebRequest = DirectCast(WebRequest.Create("https://forums.zybez.net/index.php?app=curseauth&module=global&section=login&do=process"), HttpWebRequest)
        postReq.Method = "POST"
        postReq.KeepAlive = True
        postReq.CookieContainer = tempCookies
        postReq.ContentType = "application/x-www-form-urlencoded"
        postReq.Referer = "https://forums.zybez.net/index.php?app=curseauth&module=global&section=login&do=process"
        postReq.UserAgent = "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0"
        postReq.ContentLength = byteData.Length
        'ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3


        Dim postreqstream As Stream = postReq.GetRequestStream()
        postreqstream.Write(byteData, 0, byteData.Length)
        postreqstream.Close()

        Dim postresponse As HttpWebResponse
        postresponse = DirectCast(postReq.GetResponse(), HttpWebResponse)
        tempCookies.Add(postresponse.Cookies)
        logincookie = tempCookies

        Dim postreqreader As New StreamReader(postresponse.GetResponseStream())

        Dim thepage As String = postreqreader.ReadToEnd

        RichTextBox1.Text = thepage

    End Sub

    Private Sub Button2_Click(sender As Object, e As EventArgs) Handles Button2.Click

        WebBrowser1.DocumentText = RichTextBox1.Text

    End Sub

End Class
 

Attachments

  • test1.png
    test1.png
    91.8 KB · Views: 321
  • test2.png
    test2.png
    69.6 KB · Views: 341
Last edited:
You are sending a static auth key:
auth_key=880ea6a14ea49e853634fbdc5015a024

This should likely be dynamically scraped from the previous login page before you post data.

So the process would be:
Load login URL
Scrape dynamic variables
Post login information with dynamic variables (auth_key=" & DynamicAuthKey)

The referrer is also shown here:
8324e566cf783bb95743d0b2da2bde9e.png


 
Thanks for your reply Sir.

How do I Scrape dynamic variables? (DynamicAuthKey)

Regarding the Referer, you said if I use the "Referer" you quoted above it's also gonna work?
I'm afraid cause the "Referer" doesn't have login & password in it, as shown in the video.
 
Last edited:
Thanks for your reply Sir.

How do I Scrape dynamic variables? (DynamicAuthKey)

Regarding the Referer, you said if I use the "Referer" you quoted above it's also gonna work?
I'm afraid cause the "Referer" doesn't have login & password in it, as shown in the video.

The referring URL is not used to track data (In 99.99% of cases). It is however infrequently used to make sure that the user has come from their own website as an additional security check. Just make sure you are copying the same referring URL that you are seeing when tracking the data & changing any dynamic variables that are potentially within the URL. The video is showing an example from 1 website, many websites are different so you will have to adapt to how they function.

You can scrape variables on the previous login URL using regex or this function:

Code:
Friend Function GetBetween(ByVal haystack As String, ByVal needle As String, ByVal needle_two As String) As String
        Dim istart As Integer = InStr(haystack, needle)
        If istart > 0 Then
            Dim istop As Integer = InStr(istart + Len(needle), haystack, needle_two)
            If istop > 0 Then
                Try
                    Dim value As String = haystack.Substring(istart + Len(needle) - 1, istop - istart - Len(needle))
                    Return value
                Catch ex As Exception
                    Return ""
                End Try
            End If
        End If
        Return ""
    End Function

E.g.
Load Login URL
Scrape Variable, E.g. Dim DynamicAuthToken As String = GetBetween(PageHTML, "name=""authtoken"" value="", """")
Post login information with dynamic variables (auth_key=" & DynamicAuthToken)
 
Thanks,

As you said above that every websites are different so you will have to adapt to how they function.

The above web-site was actually just a test for me in order to learn how to use HttpWebRequest and Live Http Headers.

Frankly I wanted to post Ads to this web-site ( g u m t r e e . c o . z a )
So having all this Live Http Headers capture in the TXT file I attached, how do I start to write an Ad poster??

Please !
 

Attachments

Thanks,

As you said above that every websites are different so you will have to adapt to how they function.

The above web-site was actually just a test for me in order to learn how to use HttpWebRequest and Live Http Headers.

Frankly I wanted to post Ads to this web-site ( g u m t r e e . c o . z a )
So having all this Live Http Headers capture in the TXT file I attached, how do I start to write an Ad poster??

Please !

This is the same process as your first example - Simply record all headers & replicate the process in your code.

CharlesProxy is my preferred HTTP tracker, LiveHTTPHeaders is a lot harder to read the data & with CharlesProxy you can also instantly delete all data from sites that you want to ignore.

So the process would be:
Record the login - replicate & confirm working.
Record the posting process - replicate & confirm working.
Change code to allow you to add dynamic variables / a form where you can enter ad info.
 
Thanks, I downloaded your CharlesProxy.

I'll get back to you soon for more questions.

Thanks very much
 
seems like that Charles Proxy is not free,
because they proposed me to download the Free Trial Version?
 
seems like that Charles Proxy is not free,
because they proposed me to download the Free Trial Version?

No, it is a paid for software with a 30 day free trial with a slow splash screen on load. If it works for you then it is definitely worth purchasing.
 
Hi user gimme4free,

I installed CharlesProxy but I'm not really understanding it properly,
so I have questions to ask, please.

1. In the manual, they says there are two way of viewing Request (Structure and Sequence).
So which one should I use for my project?

2. I have two browsers installed and openned (FireFox and Chrome) but I don't know which one is the one that CharleProxy is using?
although I also installed the FireFox add-in of CharlesProxy but it seems not to work because when I login to that web-site from FireFox it doesn't appear in Charles, only when I login from Chrome that I see the request in Charles.

3. In your previous message, you said "Record the login - replicate & confirm working."
I'm able to record the login using the "red button" called record found In Charles but what items do I need to take from Charles in order to replicate in VB.Net (H t t p W e b R e q u e s t) ?

4. Please show me how to use CharlesProxy very well !
 
Back
Top