Re: using openurl to log into Yahoo services



On Tue, 15 Nov 2005 16:08:06 -0000,
"joe_public34" <joe_public34@xxxxxxxxx> wrote:

> Hello all,
> I'm trying to write a script to log into Yahoo! (mail, groups, etc),
> but when I pass the full URL with all form elements via Python, I get
> a resutling 400 - Bad Request page. When I just plop the full URL
> into a browser, it works perfectly. Is there something I need to
> specify in python to submit the correct info (headers, user agent,
> etc) to get the response I want? Here is the code I have that returns
> the Bad Request:

> import urllib, win32gui, win32clipboard, win32con, os, getpass, re
> yid = raw_input("Yahoo! ID: ")
> pw = getpass.getpass(prompt = 'Yahoo password: ')
> url =
> "https://login.yahoo.com/config/login?.tries=1&.src=ygrp&.intl=us&.v=0&.challenge=U4VY1YGqdPf8z3SaVccJdhV63YCw&.chkP=Y&.done=http://groups.yahoo.com&login="+yid+"&passwd="+pw+"&.persistent=y&.save=Sign
> In"
> temp = urllib.urlopen(url)
> grp_list_source = temp.read()

> Any thoughts or suggestions? Thanks.

It is possible that the "challenge" field is created by yahoo's server
based on the request that caused the server to serve the login page;
perhaps it contains a hash of the user agent that sent the request.
When you reply to that challenge at a much later time, or with a
different user agent, or with something else that's different from the
original request, yahoo's server thinks you're trying to break into
yahoo.

Regards,
Dan

--
Dan Sommers
<http://www.tombstonezero.net/dan/>
.



Relevant Pages

  • Re: Possible Yahoo Messenger security issues
    ... This appears to just be a webserver used by Yahoo ... IM to xfer files; check your IM preferences for file xfer ... The HEAD request: ... Server" window. ...
    (Vuln-Dev)
  • Re: Why doesnt this work?
    ... > resolve into a file on the server side but the client wouldn't know anything ... > To download the reply to an http request you would use e.g. the LWP module. ... # Pass request to the user agent and get a response back ...
    (comp.lang.perl.misc)
  • [REVS] NTLM HTTP Authentication is Insecure By Design
    ... in front of a web server, and that proxy server shares a single TCP ... These are attacks that make use of non-RFC HTTP requests (HTTP Request ... the authentication is associated with the ...
    (Securiteam)
  • [NT] 04WebServer Multiple Vulnerabilities (CSS, Log File Injection, AUX DoS)
    ... 04WebServer is a HTTP server developed by Soft3304 for Windows platforms. ... Characters into Log File ... filtering on the request URL before writing it into the log file. ... following HTTP request, when submitted to a vulnerable 04WebServer, will ...
    (Securiteam)
  • Re: breaking the model
    ... > The forms data then is in the Request object. ... HTTP Request; in this case, the form POST Request from the Page. ... client and server. ...
    (microsoft.public.dotnet.framework.aspnet)