PHP Curl Login

[bschultz]

My real job is as a radio announcer.  We are required to play advertising commercials for various programs that we broadcast.  I wrote a script a few years ago to automatically login to the providers website (PHP, Curl) and download the mp3's that we are supposed to play each day.

Now, the provider has updated their website and changed the login process.

It used to be (in a browser) that when you logged in, you were taken to a landing page with a unique "rowid" in the in URL.  Once you knew that rowid, you could simply go to that page, and bypass the login process.  Not very secure...but easy to scrape!

Now, when you login, you are assigned a random rowid.  Using the Firefox Deveoloper Tools, I see that there is NO cookie associated with the login.  The rowid is now set in the form processing page.  In the Developer Tools, this is seen in the Params...Query String section.

How can I extract these params (rowid) from the form processing script, and proceed to the landing page...with the rowid in the Curl command?

This just returns me to the login page..since the rowid isn't set.

Thanks!

 

$url = 'http://domain.com/formprocessing.html';
$fields = array(
	'username' => urlencode('xxx'),
	'password' => urlencode('xxx')
);

$fields_string = '';

foreach($fields as $key=>$value) { $fields_string .= $key.'='.$value.'&'; }
rtrim($fields_string, '&');

//open connection
$ch = curl_init();

//set the url, number of POST vars, POST data
curl_setopt($ch,CURLOPT_URL, $url);
curl_setopt($ch,CURLOPT_POST, count($fields));
curl_setopt($ch,CURLOPT_POSTFIELDS, $fields_string);

//execute post
$result = curl_exec($ch);

//close connection
curl_close($ch);

 

[chhorn]

if that info is still in the URL you coudl extract that

https://www.php.net/manual/en/function.parse-url.php

if it's contained in the sourcecode of that page you can try to read this out

https://www.php.net/manual/en/book.simplexml.php

[bschultz]

But the rowid isn't set until you submit the form...so parse-url returns NULL.

The flow of the login is: login page -> formprocessing page -> landing page.

In the script, I'm sending a POST to the form processing page.  Once that is done, the form processing page sets the rowid.  I can see the rowid in my browser, but CURL doesn't know that value.

[bschultz]

Upon further investigation, there is a cookie being set by a JQuery script...which in turn sets the rowid.

So, how can I get CURL to interact with Java?  Headless browser?  I've never had much success with headless browsers before.  Any tips?

Thanks!

Edited April 15, 2020 by bschultz

[TrueMember]

Try this:

$fields = array(
	'username' => urlencode('xxx'),
	'password' => urlencode('xxx'),
	'B1' => 'Submit'
);