0

There is a HTTPS site which I need to visit really often. Unfortunately, the login window seems to be some sort of CSS popup which only opens after pressing a certain menu button on that site. That is probably why Chrome doesn't offer to save the username and password for this site. Hence, I'm always forced to re-enter the username and password which is really annoying because I need to visit this site very often.

So I'm looking for alternative solutions to this problem. Back in the old days, one could just look for the CGI or PHP script that managed login and then call the login script directly by pasting the appropriate URL in the browser like so

 http://www.example.com/cgi-bin/login.cgi?user=foo&pwd=bar

However, the site I want to be logged in automatically uses HTTPS and lots and lots of JavaScript and probably other modern technologies that I know nothing of. The HTML code has lots of references to external scripts and the JavaScript seems to have been obfuscated so I can't really find the code for the "Login" button without going to great pains.

That's why I'd like to ask this question before wasting lots of time for nothing. So can anybody tell me whether it is possible at all to find out what happens when the user presses the "Login" button and then emulate this by directly calling the respective script by pasting a URL into the browser? Or is such a thing no longer possible because of SSL?

In that case, is there any other way of automating the login process for this particular site or am I really forced to re-enter username and password every single time, which is really annoying?

closed as off-topic by Steffen Ullrich, Matthew, Tobi Nary, Steve, symcbean Aug 24 '17 at 19:29

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Steffen Ullrich, Matthew, Tobi Nary, Steve, symcbean
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    This is not a question about information security. What happens on the wire can be seen for example in the developer console of the browser - no matter if HTTPS or not. One can also automate things using headless browsers or remote controlling browsers (i.e. Selenium or similar technologies). – Steffen Ullrich Aug 24 '17 at 15:14
  • Perhaps you could use something like Selenium IDE (addon for firefox) to record the process of you filling the password and logging in without knowing what is going on behind the scenes. – papakias Aug 24 '17 at 15:16
  • But is it technically possible to do a SSL login by simply finding out the login script and then calling this script manually like in the old days? (see example above) Or does this all work differently with SSL? – Andreas Aug 24 '17 at 15:27
  • Andreas: the only difference that your script needs to connect to the server with HTTPS instead of HTTP. Everything else works the same. – Steffen Ullrich Aug 24 '17 at 15:30
  • So the password is pasted into the browser URL without any encryption? And the browser sends it with encryption to the server then? – Andreas Aug 24 '17 at 15:33
1

There's no way to know without digging. However, the SSL part doesn't really matter. There are other issues that could make this impossible though. To name just a couple:

  1. If the login form is protected from CSRF attacks then you specifically will not be able to paste a URL in your browser's address bar and login. CSRF protection stops that exact kind of behavior
  2. If the website uses a modern front-end app that communicates with the server exclusively via API calls, then a simple login wouldn't really do it anyway. Rather, the login form is executing an API request to fetch authorization key of some kind, which is then stored in the front-end application. As a result even if you could manually post to login form, that wouldn't do you any good. Instead, the response has to be received by the front-end application to initialize itself.

That's just two off the top of my head. In essence, there are definitely some cases where what you are trying to do will be impossible. Whether or not that is the case for this particular instance is anyone's guess.

  • Thanks for the clarification. I was expecting something like this... some kind of modern technology that prevents circumventing the front-end. It all looks very modern so I'd guess that it uses some kind of front-end app communicating with a server. – Andreas Aug 24 '17 at 18:48

Not the answer you're looking for? Browse other questions tagged or ask your own question.