wget script question

sidkdbl07 · 10-28-2010, 12:33 PM

I'm trying to get to a website that requires a login.

The login page has extra form variables (other than username and password)

Code:

<form name="form1" method="post" action="login.aspx" id="Form1">
  <input type="hidden" name="_VIEWSTATE" id="_VIEWSTATE" value="/sdfsdf......"" />
  <input type="hidden" name="_EVENTVALIDATION" value="/weENTKJJ..." />
  ...
  <input type="text" name="Login_cnttrl$txtUserName" />
  <input type="password" name="Login_cnttrl$txtPassword" />
  ...
  <input type="submit" name="Login_cntrl1$Button1" value="Login"
</form>

The _VIEWSTATE and _EVENTVALIDATION fields change everytime I load the page, so I assume they are important for the login.

When I try the following, the login is not successful:

Code:

wget -O - --save-cookies=cookies.txt --keep-session-cookies --post-data "Login_cnttrl$txtUserName=myUser&Login_cnttrl$txtPassword=myPassword&Login_cntrl1$Button1=Login" http://www.mysite.com

How do I gather the _VIEWSTATE and _EVENTVALIDATION values? I suspect I will need two wget statements, no?

smoker · 10-28-2010, 03:18 PM

Quote:

Originally Posted by sidkdbl07

How do I gather the _VIEWSTATE and _EVENTVALIDATION values? I suspect I will need two wget statements, no?

I would worry less about the values and spend more effort on understanding what those values represent. Once you know that, you can create your own at will. It could be a hash of your browser specs, or a coded time stamp for the page issue. Or anything else you can think of. Obviously using old values is not acceptable, so think outside the box ...

P.S. I suppose I ought to add, you would be surprised what passes for "security" sometimes.