Yahoo Account Creation Help

smack said:

Code:

<input type="text" name="yahooid" id="yahooid" value="" size="32" maxlength="32" class="" autocomplete="off">

i would venture to say that the secret value is a hash of the characters in the ID field.

looks like at the bottom of the page they are using a small js to register an onload event that inserts a link to some more js files. typically this is done to avoid null object references since the script will only be activated to register the other script libraries after, or just as the page has finished loading. this ensures that all controls the js files may be interacting with are rendered and present in the page.

my advice would be to write a quick function to hash a string using md5. then packet log the submit of a yahoo page and write down the "secret" value. then run the user id you have just submitted through YOUR md5 hash function and see if the hashed values match. if they do, you know you've got the right hashing. if they don't match try removing the @domain.com and just hashing the username. if that doesn't work, then try replacing the md5 hash with a sha1 hash.

- edit -

it is possible (however unlikely) that they are salting their hash. try to locate all the client script libraries they are registering in that page to see if you can track down which function(s) are being used and how the page is being altered once it reaches the client.

you could also just shut off javascript all together and packet log a registration without the client side scripting enabled to see what it does.

Click to expand...

smack said:

ok so here is what is is going on with the secret value.

the secret value field is written to the page using a client side script. the ID of the ID field is then combined with another value on the page that is dynamic. hashed with md5, and propagated to the secret field so it can be sent along with the post data.

the main js functions file is:

Code:

https://s.yimg.com/lq/lib/membership/ns/js/registration_start_min_waf_203063.js

so i searched through that file for "random_field"

here is what i found:

Code:

ymem_reg.attachRF=function(){if(ymem_reg.config.random_field=="none"){return}var c=document.createElement("input");var d=document.getElementById("regFormBody");c.setAttribute("type","hidden");c.setAttribute("name","random_field");c.setAttribute("id","random_field");var a=ymem_reg.config.random_field;var b=document.getElementById("u").value;a=MD5(a+b);c.setAttribute("value",a);d.appendChild(c)};

now you can see in the js there that it is creating the hidden field with an ID and name of "random_field". the linchpin to the whole script though is this line:

Code:

b=document.getElementById("u").value;a=MD5(a+b)

what this is doing, is declaring a variable, "b", then assigning its value to the value of another hidden form field named "u".

looking at the html of the page u is defined as follows:

Code:

<input type="hidden" id="u" name="u" value="a8hf4vh5sgtic">

so this js function is taking the value of the variable "a" which is defined as follows:

Code:

var a=ymem_reg.config.random_field

then it does "a+b" (in js you can use + for string concatenation). so in this case the string it is creating would be "yahooida8hf4vh5sgtic".

it then takes this string value and hashes it with md5 to produce:

9a742ed2247d8535d1bf691077f8001a

this is the value that is being sent in the post data of the packet.

the "u" value changes each time the page is requested, so what you want to do is parse out the value of the "u" field and tack it on to the end of the string value for the id field which is "yahooid".

then hash it, and send it.

in vb.net an example of an md5 hash function would look something like this:

Code:

Imports System.Security.Cryptography
Function getMd5Hash(ByVal input As String) As String
        ' Create a new instance of the MD5 object.
        Dim md5Hasher As MD5 = MD5.Create()

        ' Convert the input string to a byte array and compute the hash.
        Dim data As Byte() = md5Hasher.ComputeHash(Encoding.Default.GetBytes(input))

        ' Create a new Stringbuilder to collect the bytes
        ' and create a string.
        Dim sBuilder As New StringBuilder()

        ' Loop through each byte of the hashed data 
        ' and format each one as a hexadecimal string.
        Dim i As Integer
        For i = 0 To data.Length - 1
            sBuilder.Append(data(i).ToString("x2"))
        Next i

        ' Return the hexadecimal string.
        Return sBuilder.ToString()

    End Function

i haven't tested this with a full signup, but i have hashed and compared the values and they match. this should solve your problem.

mahalo.

Click to expand...