How can you send Username and Password without typing it?

Question

I want to create an Application (C++) for my schoolmates.

Normally they have to go to our school-website and get to the login site. There, they type their username and password, login and search for their own class.

I want my application to ask them for class, username and password, send it to the timetable site, download the url and print the timetable for them.

I'm only programming C++ so I don't have a problem with all that except the "sending username and password to the site" step. I know the HTML basics so I think i have to search for the variable names used by the site and send them together with the url somehow? I tried some things but I don't understand how that whole thing works.

<label id="username-lbl" for="username" class="required" aria-invalid="false">
"Benutzername"
<span class="star">&nbsp;*</span></label>
<input type="text" name="username" id="username" value class="validate-username required" size="25" required aria-required="true" autofocus>

This is the HTML of the Username field. Do i have to write like

...URL....\index.html&username="theusername" because the id is "username" ? I tried this and it didnt work .. i searched alot on the internet but i dont find an answer.

You don't need the quotes, and the very first variable should start with a `?` and not a `&`. E.G `...URL....\index.html?username=theusername&otherVariable=other` http://html.net/tutorials/php/lesson10.php — GrumpyCrouton, Sep 25 '17 at 15:01
How does the login HTML FORM look on the site you are trying to login on? — Emil S. Jørgensen, Sep 25 '17 at 15:07
You need to check the atribute `method` in the form, if it's `get` you can send the variables in the url, if it's `post` (as it should be to send sensible data like passwords) you can't do it that way. — MarioZ, Sep 25 '17 at 15:19

score 3 · Accepted Answer · answered Sep 25 '17 at 15:09

3

Before going any further, check the <form> element's method. The way submitted data is sent changes.

If method is GET (or missing), then submitted data is indeed appended to the URL. It is separated from the rest of the URL (as specified by the action attribute) using ? and name-value pairs are separated by &. You also need to properly URL-encode the values.
If method is POST, then data is send in the body of the request. The format depends on the enctype.

Note that there is also the possibility that the data is actually sent using XHR (aka Ajax aka XMLHttpRequest).

The easiest way to get a feel of how things work is to open the Network tab of the Development tools of your favorite browser. It'll tell you whether it's a regular page or XHR, POST or GET, etc.

Note that in many cases, the server will then set cookies to keep state, so you'll have to do the same on your side.

answered Sep 25 '17 at 15:09

jcaron

17,302
6
32
46

This is legit answer, I don't know why somebody downvoted it. – Kunok Sep 25 '17 at 15:17
I just saw the method is POST. That means i cant use the ULR method .. what do i do now ? – TypenameT Sep 25 '17 at 15:23
@TypenameT You could simply switch it to GET if you have access to the source code. If not, it will be pretty tough to transmit the data. – GrumpyCrouton Sep 25 '17 at 15:24
What library are you using to send requests to the server from your app? It probably has options to specify that you want to use `POST` rather than `GET`, and ways to provide the data to be posted. – jcaron Sep 25 '17 at 15:25
1. Nope i dont have access to the source code. 2. I started yesterday im still thinking about the library but i think i will take the "boost" one. – TypenameT Sep 25 '17 at 15:27
Not familiar with Boost, but from what I understand, it does not include http client code. There are apparently several projects for this, see https://stackoverflow.com/questions/2251361/boost-asio-based-http-client-library-like-libcurl – jcaron Sep 25 '17 at 16:32

Kunok · Answer 2 · 2017-09-25T20:19:26.277

0

So your C++ program should collect params required and generate valid HTTP POST request.

First you should inspect how that POST request looks like. One of possible ways to do so is using browser developer tools, network tab:

Inspect all headers and bodies. See how these things work and try to make hardcoded request and send it from your C++ program using some HTTP library.

It might authenticate your user and return token or other value that you might use to authenticate requests from your program, and then for other requests include these headers so you can act as a user and fetch user content.

This also depends on authentication implementation, some strategies allow you to do so while some are protected. But I successfully used this technique on production-steady application. I could send various cURL requests and visit pages from my terminal acting as logged in user without logging in or using browser at all. (I didn't login because I just "stole" session from already logged in (and probably remembered) user). In your case you need to login first to obtain these headers (also using your C++ HTTP lib) and then inject new headers to future requests that fetch data.

edited Sep 25 '17 at 20:19

answered Sep 25 '17 at 15:03

Kunok

8,089
8
48
89

Missing `?` in url for `username`. And also, this explanation would be very confusing to any new HTML/PHP developers. – GrumpyCrouton Sep 25 '17 at 15:04
@GrumpyCrouton Added it now, I missed it, but that's just example string trying to picture what I'm saying. – Kunok Sep 25 '17 at 15:05
1

Yes but the example string is very important as it seems to be the part OP is struggling with :P – GrumpyCrouton Sep 25 '17 at 15:05
@GrumpyCrouton I fully agree. And yes it's a bit confusing explanation, but I am trying to give picture of the context. I am not PHP developer myself so I can't provide good code examples, I hope someone will answer with better explanation and code example. Meanwhile, I hope this answer helps just a little bit. – Kunok Sep 25 '17 at 15:06
If you look at my comment under the initial post I have a link in there that goes to a page explaining how url variables work, feel free to add that to your answer for some brownie points. :) – GrumpyCrouton Sep 25 '17 at 15:09
As the other answer said, this doesnt work if the method is POST. It uses the POST method .. :\ – TypenameT Sep 25 '17 at 15:25
@TypenameT I made full edit now that I understand your question. This might help you, depending on how they implemented authenication on that website. – Kunok Sep 25 '17 at 15:51
@Kunok thank you ! I will try that. Wich libary did you use when you did that ? Is the boost.asio libary good for it? – TypenameT Sep 25 '17 at 19:39
@TypenameT as long as it can send HTTP POST request it's good, and if that doesn't work for you, you can try this one: http://cpp-netlib.org/ , https://github.com/yhirose/cpp-httplib also IMO the easiest way to test your HTTP request is using cURL or Postman. Try to inspect how their auth works and see HTTP headers, you might use them to authorize outside of their web interface. – Kunok Sep 25 '17 at 20:16

How can you send Username and Password without typing it?

2 Answers2