Keep HTTP-Alive in pascal ?
lazarus / 38-Networking and Web Programming

----------------------------------------------------------------------
sk.loda98 · 2015-07-08 11:29

I'm making a program to auto access this site
http://ringzer0team.com/login
All you need to login is username,password,csrf i already had.
take username & password is 'test12222' for example
So anyone can tell me why it doesn't work.     >

Code: [Select]procedure TForm1.Button2Click(Sender: TObject);
  var
        URL: string;
    Params: string;
    Response: TMemoryStream;
    i:longint;
        S:ansistring;
  begin
    httpClient:= THTTPSend.Create;
        if httpClient.HTTPMethod('GET',
'http://ringzer0team.com/login') then
        httpClient.Document.SaveToFile('1.txt');
        httpClient.Free;
        system.assign(fi,'1.txt');
        reset(fi);
        for i:=1 to 62 do readln(fi,S);
        cs:=copy(S,21,32);
        system.close(fi);
        Response := TMemoryStream.Create;
        try
        URL := 'http://ringzer0team.com/login';
        Params := 'username=' + EncodeURLElement('test12222') + '&' +
'password=' + EncodeURLElement('test12222') + '&' + 'csrf=' +
EncodeURLElement(cs);
        system.assign(fi,'text');
        if HttpPostURL(URL, Params, Response) then
Response.SaveToFile('login.html');
    finally
    Response.Free;
    end;
   end;

----------------------------------------------------------------------
ChrisF · 2015-07-08 18:54

You are not explaining what you mean exactly with: "it doesn't work".
Furthermore I don't know Synapse .

Anyway, according to some quick tests with this web site, you must at
least:

1/ use a cookie, common to both your first "get" order  and your
second "post" order. A "PHPSESSID" value is used in the cookies, in
conjunction with the value of your "csrf" variable.

2/ send exactly the string inside your "Params" variable. For
instance:

Correct (Content-Length: 77):
Code: [Select]username=testuser&password=testpassword&csrf=3913eb3d265
129ce75aab0576109d2a9
Incorrect (Content-Length: 85):
Code: [Select]username=testuser%26password%3Dtestpassword%26csrf%3Dea7
48a8ade66466aaa212dc6ecb55dd8
3/ indicate the Content-Type: application/x-www-form-urlencoded


Here is for instance, a log of a "POST" request that seems to be
working. Done with Indy:
Code: [Select]Sent:
POST /login HTTP/1.0<EOL>
Connection: keep-alive<EOL>
Content-Type: application/x-www-form-urlencoded<EOL>
Content-Length: 77<EOL>
Host: ringzer0team.com<EOL>
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8<EOL>
Accept-Encoding: identity<EOL>
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:29.0) Gecko/20100101
Firefox/29.0<EOL>
Cookie: lt;EOL>
<EOL>

Sent:
username=testuser&password=testpassword&csrf=79be4949366b1fc9ff0da6c74
3868e96

I've written "seems to be working" because of course I don't have any
valid username/password to connect to this site.

But, with this request, I'm getting what I supposed to be the correct
answer of the server (which I don't get if I'm not respecting the
above conditions):
Code: [Select]<div class="alert alert-danger" role="alert">Login
failed invalid username / password.</div>

----------------------------------------------------------------------
sk.loda98 · 2015-07-09 06:59

Yep. Seem you're right because it's through the csrf code.
I writed a program to read the csfr. but my mistake is clear all data
like cookies ,agent,etc.  before make a POST.

----------------------------------------------------------------------
fpcoder · 2015-07-09 19:34

If you don't get logged in, this might help:

http://sourceforge.net/p/synalist/mailman/message/32145635/