[how to know when websites generate hidden variables]

Hey, I have figured out the answer if anyone is interested. It is not always possible to find the variables by fetching them from the website source. Sometimes they are generated on the server side, or it might be done on the client side in a complicated way to make it difficult to reproduce. Sometimes complicated forms are encoded and sent through the headers.

 

One answer is to use selenium firefox plugin and reverse engineer the actions done by the browser. You can record the actions and then export as php, java, C/C++ or whatever. This doesn't actually have any limitations, and it can automate any action done by a web browser.

 

PHP curl does have it's limitations, and the variables sent through the headers might change every time, so they can't be used for future automation.

[how to know when websites generate hidden variables]

when I post to forms through php curl, there are some variables being sent that are not entered by the user when using a web browser. I am able to see which variables are being sent using livehttpheaders. Some variables are changing values dynamically, and it is not always possible to find the value of the hidden variables in the source code of the webpage. I want to find those values, so that I can post to specific websites.

 

I am usually able to find the hidden variables in the source code, but sometimes that's not possible.

 

hidden variables can look like e.g. sid=qt44ry2wr5y45ywhy55he5ty. You can find the previous value in livehttpheaders, but the value might change dynamically, so that next time you visit the page the variable is different.

[how to know when websites generate hidden variables]

I meant, sometimes you don't know how the variables being sent are generated, because they're not entered manually. How do you know how these variables were given their value?

 

 

[how to know when websites generate hidden variables]

I know that it is possible to see what is sent by looking at livehttpheaders, but how do you know how hidden variables are generated?

 

I don't think that that's possible to see that from live httpheaders.

[How to do redir.php?page=http://****.com]

I just don't know. I am using hostgator. I don't understand the problem.

[How to do redir.php?page=http://****.com]

I have tried to make a redirect like this: redir.php?page=http://****.com

<?php
if(is_file($_GET['page'])){$page = $_GET['page'];}
else{$page = "DEFAULT.php";}
header("Location: ".$page);
?>

But I only get:

 

Forbidden

 

You don't have permission to access /redir.php on this server.

 

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

What should I do? Could it have something to do with encoding of special characters?

 

Ordinary php scripts like

<?php
echo "Hello";
?>

Works fine.