server side auto login

[raka]

Hello, this is my first post on this forum, which I found very helpful. Thanks to all the people at work here.

I am trying to log-into a third party website (say gmail.com) with username and password auto-filled from the server side. This is for a research purpose - I am trying to evaluate the behavior of some people when they are randomly logged into an account.

Thus I have (say 5 username/password) combinations and whenever one of my survey candidate click on a link (say tiny.url) they are randomly redirected to (or provided in a frame) a gmail.com page with username and password information automatically filled. it would be even wonderful if the form automatically submits but even the auto-fill will do the work.

I looked at bunch of stuff in Perl but couldnt find something that I can call a working solution. Thus I would really appreciate your help. Thx.

currently trying curl_postfields but no luck so far. :(

[Readie]

Welcome to webmaster World raka.

Do you mean send a person to gmail.com, and have them logged into an account?

In which case, you could do it with a form that posts to the gmail.com page:

<form method="post" action="https://www.google.com/accounts/ServiceLogin?service=mail&passive=true&rm=false&continue=http%3A%2F%2Fmail.google.com%2Fmail%2F%3Fui%3Dhtml%26zy%3Dl&bsv=zpwhtygjntrz&scc=1&ltmpl=default&ltmplcache=2">
<input name="Email" type="hidden" value="USERNAME">
<input name="Passwd" type="hidden " value="PASSWORD">
<input type="submit" value="Go">
</form>

Getting that form to automatically post could possibly be done with a JavaScript

[raka]

thanks Readie. I appreciate your help and it does work for gmail.

Actually another issue is that I am trying to log-into both gmail and last dot fm with same userid/pass (sort of single sign-on). but it does not work for last.fm. I guess the form on last.fm clears the form while being loaded and thus overwrites any value that is submitted. Thus I will need something that autofills after the page loads.

I have been looking into cross domain iframes but with almost no luck. same with php curl.

I would appreciate if you have any more suggestions...

[Readie]

<input name="Email" type="hidden" value="USERNAME">
<input name="Passwd" type="hidden " value="PASSWORD"> 

I suspect your issue with last fm is more the input names than some convoluted anti-post coding.

You'll need to view the source code at last fm and find what the input names are for the username and password.

[raka]

I agree with you but I have tried the correct input name and unfortunately it still keeps the box empty:

<form method="post" action="https://last.fm/login"> 
<input name="username" type="hidden" value="me"> 
<input name="password" type="hidden" value="pass"> 
<input type="submit" value="Go"> 
</form> 

here is the stripped version from their webpage:

<form method="post" action="/login/">
<input type="hidden" name="refererKey" value="" />
<input type="text" id="username" name="username" class="LoginBox" style="width:98%;" value="" />

<script type="text/javascript">$("username").focus();</script>

<input type="password" id="password" name="password" value="" class="LoginBox" style="width:98%;" /><input 

type="submit" value="Come on in" name="login"/>
</form>

[Readie]

Try naming your submit button "login" and giving it the value "Come on in" - you can retrieve the value of submit buttons with $_POST

[raka]

thanks readie...

unfortunately it doesnt seem to work either. not sure what you meant by retrieving the post values - since I dont have access to the last.fm.

Now I am trying cross domain frame communication, which also seems kind of tricky.. any suggestions?

[Matthew1980]

Hi there raka,

unfortunately it doesnt seem to work either. not sure what you meant by retrieving the post values

The $_POST values are the values that are submitted by/with the form when you press send/submit, if you want to see what these values are you print them to screen by using the print_r() function. $_POST is an array, so using print_r() will print the array to screen, and you can use this to see what values are being sent by the form to the action attribute of the form tag.

So if you want to see the values you are passing, alter the action of the form to test.php, and in test.php (create the file), simply put:-

<?php
print_r($_POST);
?>

Keep test.php in the same directoy so that the paths match, and, when you hit submit, test.php will be called, and you will then see what vaules are being sent. Easy as that!

From that you will know what values, and what keys the values are attached to. At least I think as this is what Readie is getting at ;-p

WRT your snippet, I think that if you changed your submit name & value to the same thing, this will make life easier, but check the values first to see what the submit is called, probably login from what I can see, "come on in" will be the text on the button.

Cheers,

MRb

[raka]

Thanks Matthew (MRb). I really appreciate your explaination.

So I created a page to get the post values and copied the last.fm/login page on my computer and when submitted posted the values to that page.

Array ( [refererKey] => [username] => me [password] => pass [login] => Come on in ) 

I then created a form to match those values but still it doesnt work. I guess the issue probably is with the refererKey, which might be created dynamically on their server to validate the page submitting the information.

any additional thoughts?

Thanks.

[Matthew1980]

Hi there raka,

Interesting as they use an empty value there, you could well be right about the key being generated after the post is set. I think that the referred login that you are trying may not work, and they only want you to login from their own site, which is understandable..

Hopefully someone else reading this thread could shed light on this ? ;-p

Sorry I can't help further, but without knowing what the refererkey does your pretty much driving in the dark!

Everything else was being set correctly, and using the action="...last.fm/login/" (three dots are in place of the https: ect) you need the trailing slash by the looks of it too. Thats the only other thing as I can see that you were missing from your post...

Cheers,

MRb