How to create URL's with form info? (like the Yahoo clip)

madmaxmedia · 09-23-2004, 04:41 PM

Hi all,

I think it would be useful to come up with some general information on creating URL's for iSilo that contain form information (mainly logins). These would also be useful for mobile web browsers, so you wouldn't have to re-enter your login information when you access these sites.

There are a few iSilo channels that have such URL's, such as the NY Times and Yahoo-

http://www.nytimes.com/auth/login?is_continue=true&OQ=&USERID=youruserid&PASSW ORD=yourpass&log=Log+In&SAVEOPTION=YES&URI=http://www.nytimes.com/pages/magazine/text/

http://login.yahoo.com/config/login?&.done=http://pg1.yahoo.com/raw?dp=home&login=youruserid&passwd=yourpass

I've looked at the source code of those login pages, but I don't know enough HTML to figure out how to create URL's for other pages. I've tried creating URL's with some other login pages, but haven't gotten anywhere.

Does anyone have any tips?

Thanks!
Steve

ignatz · 09-23-2004, 10:42 PM

[I edited your message to remove the url parsing on your example links so they could be shown in their entirety.] I have very little knowledge of picking these apart through the code. I would imagine that you would have to simply watch the urls and discover them for each site (though I think that most will be pretty similar to what you show above). But I'm probably wrong!

hacker · 09-24-2004, 01:32 AM

You are opening yourself up for a huge number of risks, by passing a username and password to remote sites you fetch. Not only does that pass the information across your network, your ISP's network, their backbone provider's network, and so on in the clear, but others can capture and misuse it for their own maliscious deeds.

Even if you don't care if someone has the username and password for your website logins, you've now given maliscious users one more item of information about you, one of your usernames, that they can try to exploit elsewhere, such as other websites that you might visit frequently.

I'd strongly advise against what you're asking to do.

Once you are willing to accept that risk (and I wouldn't be, I use a different password for every account I'm responsible for, changed every 30 days, religiously), you have to realize that this will only work with a limited number of sites.

Some sites store the login information in browser cookies, others in session cookies, others behind SSL, others pass the info in the URI field of the browser, and yet others, it is passed in form fields via a POST to the remote server.

Alexander Turcic · 09-24-2004, 03:09 AM

Steve,

there are several ways how to approach this problem. It always involves inspecting the html source code. Often it is useful to also sniff headers; a cool extension for firefox which does that is LiveHTTPHeaders.

In general, passing parameters via url only works when you are dealing with GET variables. Have a look here to understand the fundamental difference between the two available methods, GET and POST.

So when you inspect an html source code, and figure out that the login form (or whatever form your are inspecting) uses something like method="get", then it is possible to add the transmitted variables to the url.

Another great tool to check what variables are being passed within a form is Firefox's "View Page Info" (right mouse click). In the Tab Forms, it shows you a form's fields, including name, type and current value.

Tell me if that helps you in any way.

09-23-2004, 04:41 PM	#1
madmaxmedia Connoisseur Posts: 76 Karma: 510 Join Date: Aug 2003 Location: Los Angeles, CA Device: Sony CLIE TG50	How to create URL's with form info? (like the Yahoo clip) Hi all, I think it would be useful to come up with some general information on creating URL's for iSilo that contain form information (mainly logins). These would also be useful for mobile web browsers, so you wouldn't have to re-enter your login information when you access these sites. There are a few iSilo channels that have such URL's, such as the NY Times and Yahoo- http://www.nytimes.com/auth/login?is_continue=true&OQ=&USERID=youruserid&PASSW ORD=yourpass&log=Log+In&SAVEOPTION=YES&URI=http://www.nytimes.com/pages/magazine/text/ http://login.yahoo.com/config/login?&.done=http://pg1.yahoo.com/raw?dp=home&login=youruserid&passwd=yourpass I've looked at the source code of those login pages, but I don't know enough HTML to figure out how to create URL's for other pages. I've tried creating URL's with some other login pages, but haven't gotten anywhere. Does anyone have any tips? Thanks! Steve

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Classic Will Nook clip ?	Prince Hal	Barnes & Noble NOOK	0	02-18-2010 10:55 PM
The clip?	ardeegee	Sony Reader	6	09-24-2009 12:52 PM
Plucker URL's	errolgreer	News	0	07-01-2009 04:36 AM
Plucker URL's	errolgreer	Introduce Yourself	3	06-30-2009 09:30 PM
iLiad Create form like Connection Manager	Kiba	iRex Developer's Corner	12	07-16-2008 05:06 AM

09-23-2004, 10:42 PM	#2
ignatz mechanoholic Posts: 582 Karma: 1000217 Join Date: Mar 2004 Location: Sarasota, FL Device: Nook STR/iPhone 4S/EVO 4G	[I edited your message to remove the url parsing on your example links so they could be shown in their entirety.] I have very little knowledge of picking these apart through the code. I would imagine that you would have to simply watch the urls and discover them for each site (though I think that most will be pretty similar to what you show above). But I'm probably wrong!

09-24-2004, 01:32 AM	#3
hacker Technology Mercenary Posts: 617 Karma: 2561 Join Date: Feb 2003 Location: East Lyme, CT Device: Direct Neural Implant	You are opening yourself up for a huge number of risks, by passing a username and password to remote sites you fetch. Not only does that pass the information across your network, your ISP's network, their backbone provider's network, and so on *in the clear*, but others can capture and misuse it for their own maliscious deeds. Even if you don't care if someone has the username and password for your website logins, you've now given maliscious users one more item of information about you, one of your usernames, that they can try to exploit elsewhere, such as other websites that you might visit frequently. I'd strongly advise against what you're asking to do. Once you are willing to accept that risk (and I wouldn't be, I use a different password for every account I'm responsible for, changed every 30 days, religiously), you have to realize that this will only work with a limited number of sites. Some sites store the login information in browser cookies, others in session cookies, others behind SSL, others pass the info in the URI field of the browser, and yet others, it is passed in form fields via a POST to the remote server.

09-24-2004, 03:09 AM	#4
Alexander Turcic Fully Converged Posts: 18,171 Karma: 14021202 Join Date: Oct 2002 Location: Switzerland Device: Too many to count here.	Steve, there are several ways how to approach this problem. It always involves inspecting the html source code. Often it is useful to also sniff headers; a cool extension for firefox which does that is LiveHTTPHeaders. In general, passing parameters via url only works when you are dealing with GET variables. Have a look here to understand the fundamental difference between the two available methods, GET and POST. So when you inspect an html source code, and figure out that the login form (or whatever form your are inspecting) uses something like method="get", then it is possible to add the transmitted variables to the url. Another great tool to check what variables are being passed within a form is Firefox's "View Page Info" (right mouse click). In the Tab Forms, it shows you a form's fields, including name, type and current value. Tell me if that helps you in any way.

Advert