Some cURL help?
Hi all,
I'm currently messing about with cURL and am having a problem with cookie validation. At the moment i am wanting to display HBH as if i went to it direct. So for this i need a valid cookie and user agent right? Any help with why the following code isn't working (i've starred my specific details out)?
<?php
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, "http://www.hellboundhackers.org/index.php");
curl_setopt($curl, CURLOPT_COOKIE, "PHPSESSID=************; fusion_user=*****.*****************");
curl_setopt($curl, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11");
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_VERBOSE, 1);
$page = curl_exec($curl);
curl_close($curl);
echo $page;
?>
<?php
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, "http://www.hellboundhackers.org/index.php");
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($curl, CURLOPT_COOKIE, "PHPSESSID=session; fusion_user=id.hash");
curl_setopt($curl, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11");
curl_setopt($curl, CURLOPT_VERBOSE, 1);
$page = curl_exec($curl);
curl_close($curl);
echo $page;
?>```
That works fine for me.
MrMayhem wrote: Ahhh how stupid of me, no i have been running the script from my external web server. Thanks for the help guys, ill get php installed on my local and give it a bash.
You could do that, or you can make your script login to the server. Not sure if CURL has a Post request function (don't use it), but if it doesn't, here's the rfc that should help: http://www.w3.org/Protocols/rfc2616/rfc2616.html
I decided to try PHP and cURL. I thought it would be good practice to redo the timed challenges. (note: i have completed all but timed 7, almost done.) But, when I try this script I get a blank page:
<?php
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, "http://www.hellboundhackers.org/challenges/timed/timed1/index.php");
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($curl, CURLOPT_COOKIE, "PHPSESSID=session; fusion_user=id.hash;");
curl_setopt($curl, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)");
curl_setopt($curl, CURLOPT_VERBOSE, 1);
$page = curl_exec($curl);
curl_close($curl);
echo $page;
?>
I also tried using fsockopen(). But, it will not insert the fusion_user. It inserts the cookie: PHPSESSID.
<?php
$url = "/challenges/timed/timed1/index.php";
$fp = fsockopen("www.hellboundhackers.org", 80, $errno, $errstr, 30);
if (!$fp) {
echo "$errstr ($errno)<br />\n";
} else {
$out = "GET $url HTTP/1.1\r\n";
$out .= "Host: www.hellboundhackers.org\r\n";
$out .= "Cookie: PHPSESSID=session\r\n";
$out .= "Cookie: fusion_user=id.hash\r\n";
$out .= "Connection: Close\r\n\r\n";
fwrite($fp, $out);
while (!feof($fp)) {
echo fgets($fp, 1024);
}
fclose($fp);
}
?>
korg wrote: Use: $page = curl_exec($curl); echo $page
Your closing curl before it echoes. Hm, would that really matter though? As long as the call to curl_exec is made before the connection closes, and the return of that gets stored in $page, it shouldn't matter when $page is used, even after curl_close is called. Unless I'm mistaken.
@OP: elmiguel, you don't need the verbose, followlocation, or useragent options for the timed challenges. So I think your problem is how you're sending cookies. The only cookie you need to send is your fusionid. The PHPSESSID (except for Timed 7) and _csuid cookies are unnecessary, so you might as well not include the PHPSESSID cookie in the cookie option.
I've never closed curl before all functions are done. Also You should include the fusion_user and phpsession id. I had some problems connecting without them both, Anyway this works fine for me:
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL,"http://www.hellboundhackers.org/challenges/timed/timed1/index.php");
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($curl, CURLOPT_VERBOSE, 1);
curl_setopt($curl, CURLOPT_COOKIE,"fusion_user=xxxxxxxxxxxxxxxx; PHPSESSID=xxxxxxxxxx;");
curl_setopt($curl, CURLOPT_USERAGENT, "Mozilla/5.0 (X11; U; Linux i686; it; rv:1.8.1.5) Gecko/20070713 Firefox/2.0.0.5");
$page = curl_exec($curl);
echo $page
?>
korg wrote: Also You should include the fusion_user and phpsession id. I had some problems connecting without them both Are you sure you needed phpsessid? I used Perl for all the timed challenges except 7, and I only needed the fusion_user cookie. Though I did use PHP and cURL for Timed 7, and I did need the PHPSESSID cookie, but that was only to handle retrieving the barcode image.
I have read over system's class and function for cURL. Both, give the same result as well as trying the other revisions. It just echos out a blank page.
And yes you do need to use the PHPSESSID and the fusion_user. I have seen a sample script from another challenge done in php it required both. I am starting to wonder if the cURL is not working properly although I followed the instructions fro installing it to the "t". Any other suggestions on why this could be happening? (system?)
elmiguel wrote:
I also tried using fsockopen(). But, it will not insert the fusion_user. It inserts the cookie: PHPSESSID.
<?php
$url = "/challenges/timed/timed1/index.php";
$fp = fsockopen("www.hellboundhackers.org", 80, $errno, $errstr, 30);
if (!$fp) {
echo "$errstr ($errno)<br />\n";
} else {
$out = "GET $url HTTP/1.1\r\n";
$out .= "Host: www.hellboundhackers.org\r\n";
$out .= "Cookie: PHPSESSID=session\r\n";
$out .= "Cookie: fusion_user=id.hash\r\n";
$out .= "Connection: Close\r\n\r\n";
fwrite($fp, $out);
while (!feof($fp)) {
echo fgets($fp, 1024);
}
fclose($fp);
}
?>
The reason for that is that you have set "Cookie: " twice. Only set it once and include the whole needed part like so: PHPSESSID=<whatever you've got>; fusion_user=<whatever you've got>; You also need to include "User-Agent: whatever" for HBH to take you seriously. This doesn't even have to be your real user agent, you can put anything there. Like: User-Agent: suck me off hbh, I don't have a proper user agent!
Edit: and don't forget your \r\n.
This is what I am getting with fsockopen and adding in the user agent:
HTTP/1.1 302 Found Date: Mon, 10 Aug 2009 21:33:02 GMT Server: Apache X-Powered-By: PHP/5.0.4 Set-Cookie: PHPSESSID=<session id>; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: fusion_visited=TRUE; expires=Tue, 10 Aug 2010 21:33:02 GMT; path=/ Set-Cookie: fusion_user=deleted; expires=Sun, 10 Aug 2008 21:33:01 GMT; path=/ Set-Cookie: fusion_lastvisit=deleted; expires=Sun, 10 Aug 2008 21:33:01 GMT; path=/ Location: ../../../index.php Content-Length: 0 Connection: close Content-Type: text/html
using :
<?php
$url = "/challenges/timed/timed1/index.php";
$fp = fsockopen("www.hellboundhackers.org", 80, $errno, $errstr, 30);
if (!$fp) {
echo "$errstr ($errno)<br />\n";
} else {
$out = "GET $url HTTP/1.1\r\n";
$out .= "Host: www.hellboundhackers.org\r\n";
$out .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)\r\n";
$out .= "Cookie: PHPSESSID=session id;fusion_user=id.hash\r\n";
$out .= "Connection: Close\r\n\r\n";
fwrite($fp, $out);
while (!feof($fp)) {
echo fgets($fp, 1024);
}
fclose($fp);
}
?>
elmiguel wrote: This is what I am getting with fsockopen and adding in the user agent:
HTTP/1.1 302 Found Date: Mon, 10 Aug 2009 21:33:02 GMT Server: Apache X-Powered-By: PHP/5.0.4 Set-Cookie: PHPSESSID=<session id>; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: fusion_visited=TRUE; expires=Tue, 10 Aug 2010 21:33:02 GMT; path=/ Set-Cookie: fusion_user=deleted; expires=Sun, 10 Aug 2008 21:33:01 GMT; path=/ Set-Cookie: fusion_lastvisit=deleted; expires=Sun, 10 Aug 2008 21:33:01 GMT; path=/ Location: ../../../index.php Content-Length: 0 Connection: close Content-Type: text/html
Well did your session run out and you got logged out before you tried it? Either way, just take whatever cookies you have now, stickem in there and try again to make sure.
-Kurt- wrote: Remember, the cookies here are IP based. If you were trying to use cookies you got from home over where you work, they won't work. Seems to me he was trying at work first and then at home, not the other way around. Anyhow, it's still true and elmiguel, I'm not sure exactly what you did when you put in new cookies, but clearing the cache won't get rid of old cookies. Clearing the cookies will do that however. What you got was a redirect header (302) which is supposed to show you the way to the main page on HBH. So the connection is fine, either way it must've been your cookies getting fucked up.
To restate what I said about the cache, is that I meant cookies (sorry been a long day). I was trying at work. I was thinking that my cURL install may have been messed up or something was being stop by my works network settings. Its seems like it has to be something with the redirect with the 302 error as COM stated. I will look into tomorrow at work.
elmiguel wrote: Its seems like it has to be something with the redirect with the 302 error as COM stated. I will look into tomorrow at work. I wouldn't say 302 constitutes an error, as said, all it does is indicate a redirect with the necessary information to where (the "Location:" part). It's the best way to handle redirects when necessary as it doesn't depend on support for scripts or meta tags. As I said odds are that you just fucked something up with your cookies at work, your work's network should have nothing to do with it as the requests are going through. If you're tired you might've just made a copy paste mistake or forgotten to save it properly or anything like that. Can happen to anyone.