Question

Hey people I have a script that I found on the internet that can login to facebook this works well but now I try on another website to log in I get the 500 error.

    Dim cookieJar As New Net.CookieContainer()
    Dim request As Net.HttpWebRequest
    Dim response As Net.HttpWebResponse
    Dim strURL As String = "http://xtract.basdistributie.nl:4040/Account/LogOn"

       Try 
        request = Net.HttpWebRequest.Create(strURL)
        request.UserAgent = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
        request.Method = "GET"
        request.CookieContainer = cookieJar
        response = request.GetResponse()

        For Each tempCookie As Net.Cookie In response.Cookies
            cookieJar.Add(tempCookie)
        Next

        'Send the post data now
        request = Net.HttpWebRequest.Create(strURL)
        request.UserAgent = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
        request.Method = "POST"
        request.AllowAutoRedirect = True
        request.CookieContainer = cookieJar

        Dim writer As StreamWriter = New StreamWriter(request.GetRequestStream())
        writer.Write("username=???????&password=????????")
        writer.Close()

        response = request.GetResponse()

        'Get the data from the page
        Dim stream As StreamReader = New StreamReader(response.GetResponseStream())
        Dim data As String = stream.ReadToEnd()
        response.Close()

        If data.Contains("BAS Distribution Xtract") = True Then
            MsgBox("ingelogd")
        End If
        MsgBox(data)
    Catch e As Exception
        If TypeOf e Is WebException AndAlso DirectCast(e, WebException).Status = WebExceptionStatus.ProtocolError Then
            Dim errResp As WebResponse = DirectCast(e, WebException).Response
            ' read the error response
            Using respStream As Stream = errResp.GetResponseStream()
                MsgBox(e.ToString)
            End Using
        End If
    End Try

the error message finds place on response = request.GetResponse () I’ve also tried with Fidler to get a better error message but have never worked with this.I have also read about something on the internet that the error is because the website is built in asp instead of .net is this True?.

all help appreciated

Answer 1

The reason that facebook’s login mechanism doesn’t work with this other site is because they probably don’t have the same login form parameters.

Here’s how you should proceed (Although an exact answer is not possible at this point)

1. Use your browser to navigate to the website you want to log into
2. Examine the HTML of the login form to get the actual parameter names. For example this site might use ‘uname’ instead of ‘username’ and stuff like that.
3. edit your code to POST a value for each input on the form

If this doesn’t work:

1. Install WireShark or something similar so you can view HTTP Traffic
2. Navigate to the website with your browser
3. Login with your browser and use wireshark to view the login request. Pay particular attention to the POST variable names and values and header information
4. Update your script as appropriate

If you need help with step 4 can you please edit your post to include information from step 3.

WIRESHARK

Below is a brief description on how you can use wireshark here. I’m not going into detail on filtering or anything like that. You can use your eyes to filter 😛

When you open wireshark you are shown a list of interfaces. Step 1 is to select an interface…

• if you are connected via wifi select one of the wlan interfaces. Hopefully there is only one. You can rely on trial and error to get the right one otherwise
• if you are connected via a network cable then choose eth0. Hopefully there is only one etc etc.

If the list of interfaces didn’t show up there should be an icon at the top left of the window that looks sortof like a printer. Clicking on it will let you select the interface (click Start to start capturing).

Log in on your website (using your browser) and immediately stop the capture by clicking on the icno with the red x.

Now you need to find the correct packet…

The protocol you are interested in is HTTP. The name of the domain you are accessing might show up in the info column. For now I’m just going to assume that it does. If it doesn’t just say so as a comment. Also if you see SSL then this might be useless. I am not yet very knowledgeable on ssl…

OK, so you can now identify the packets that you sent to the web app. Find one that says POST and see what’s inside it. If that’s your login stuff then it’s a win.

Take note of all information that looks relevant.

Now if you repeat the whole process using your application to try to login and find that login packet then you can play spot the difference.