Webmail Login

[oltelman]

I started modifying a filter found here to automate the login process to websites.  I've always wanted to login here without using MS.  I've heard they don't keep a secret very well!  It worked so well I decided to try this with my webmail account.  After searching the source of http://webmail.bellsouth.net I cannot find similar input lines.  I have attached the bypass source page for the URL above.  If anyone can help, I would greatly appreciate it.

Attachment: src-bypass webmail.zip 3,44 KB

 

[sidki3003]

Hi oltelman,

It's all there:

<FORM name=loginForm ...>
<snip>
<input type="text" name="USERNAME" size="10">
<snip>
<input type="password" name="PASSWORD" size="10">

/sidki

 

[altosax]

hi otelman,
i've modified the page code so you can use it to login webmail. place it on your harddisk and click on it to login from local page.

if you know html you can clear the code yourself. also you can place your username and password directly in the local page so you have only to click the button to login webmail.

http://uploaded/altosax/200281733118_webmail.zip

altosax.

 

[oltelman]

Thank you one & all for such a quick response.
sidki:  If it's all there, I don't see it.  Within the source for here there was a "value" tag for the entries.  I don't find anything like that in the webmail code.  Are you saying that the "name" tag is where I would put my entries?

altosax:   Unfortunately, for both of us, I don't know HTML code!  If I understand you, I would need to enter the data into the HTML page you sent me & then press enter to logon.  I've tried using your page a couple of times.  It doesn't seem to remember my personal data.  What am I missing?

 

[sidki3003]

You've two choices, either a filter or a ready-made local webpage.
As to the filter there are a couple of examples on this board how to do it, e.g.:

http://asp.flaaten.dk/pforum/topic.asp?ARCHIVE=&TOPIC_ID=162
http://asp.flaaten.dk/pforum/topic.asp?ARCHIVE=&TOPIC_ID=439
http://asp.flaaten.dk/pforum/topic.asp?TOPIC_ID=676

It's always the same scheme:

Name = "some name"
Active = TRUE
URL = "the URL without protocol (no html://)"
Bounds = "<forms*</form>"
Limit = 3000 or something
Match = "(*type="text" name=)1"USERNAME"(*type="password" name=)2"PASSWORD"3"
Replace = "1"oltelman's username"2"oltelman's password"3<script type="text/javascript">"
"setTimeout('document."actual form, in this case "loginForm", no quotes".submit()',300 or something);</script>$STOP()"

If you like the webpage i'm sure altosax will give you further advice.

HTH, sidki

Edited by - sidki3003 on 17 Aug 2002  04:37:59

[oltelman]

Topic ID 676 was helpful in explaining what is happening.  

sidki:  I took your example & made this filter.

Name = "Webmail Login Form Filler"
Active = TRUE
URL = webmail.bellsouth.net
Bounds = "<forms*</form>"
Limit = 3000
Match = "(*type="text" name=)1"USERNAME"(*type="password" name=)2"PASSWORD"3"
Replace = "1"My Username"2"My Password"3<script type="text/javascript">"
"setTimeout('document."loginForm".submit()',300);</script>$STOP()"

There is no visible entry in either field and if I push the "Enter" button, it reports a wrong username error.  I am assuming the message is generic for username & password error.  If I try to manually enter data into these fields, I receive the same error.  Using the toolbar to review the source reveals that, in fact that the "name" field has changed & the log shows that the filter is being used.  If I uncheck "form filler" filter, I can manually enter the data & logon.
Sidki & Alto, I appreciate your patience and continued support!



 

[oltelman]

No one has asked, but I'll tell you anyway.
JD5000 8/12 ruleset & IE 6.0...


 

[TEggHead]

Hi,

You made a booboo in the filter you constructed...the following line

Replace = "1"My Username"2"My Password"3<script type="text/javascript">"

you will need to change the 'My UserName' and the 'My Password' pieces to reflect your name and password (this is my main objection to using in filterform, it'll have your password in your config and presents risks if you exchange configs with others.
The reason you did not see anything is that the replacement text as-is is longer than 10 and thus rejected

quote:Within the source for here there was a "value" tag for the entries.  I don't find anything like that in the webmail code.  Are you saying that the "name" tag is where I would put my entries?

You will find that only one line does not have an associated VALUE, if it is really required, just add it...

in this case I've taken the liberty to extract the form and add the VALUE parm myself, all you need to do is enter the value paramaters for the USERNAME and PASSWORD inputfields

<html>
<head>
<base href="http://webmail.bellsouth.net/">
<body onload="document.PRXlogin.submit()">
<form NAME=PRXlogin action=/BellSouth/cgi-bin/gx.cgi/AppLogic+moblogin method=post>
<INPUT name=jsCapable type=hidden value=0>
<INPUT name=MAILSERVER type=hidden value=localhost>
<INPUT name=FRAMES type=hidden value=0>
<INPUT name=USERNAME size=10 value="">
<INPUT name=PASSWORD size=10 value="">
</FORM>
</body>
</html>

HTH
JarC


Edited by - TEggHead on 17 Aug 2002  10:45:40

[altosax]

hi otelman,
if you like the local page, and if have experienced that it works when you manually fill the form with your data, then open that htm page with a text editor, like notepad, search for the lines:

<input type="text" name="USERNAME" size="20">
<input type="password" name="PASSWORD" size="20">

and change them to:

<input type="hidden" name="USERNAME" size="20" value="YOUR_USERNAME_HERE">
<input type="hidden" name="PASSWORD" size="20" value="YOUR_PASSWORD_HERE">

that's all. remember to use your right username and password in the code where i've placed YOUR_USERNAME_HERE and  YOUR_PASSWORD_HERE.

also, you can modify your bookmark making it pointing to the local page.

hth,
altosax.

 

[sidki3003]

Sorry, i should be more careful when posting examples ...

As JarC pointed out, it's the value="" you have to fill with your data and to add to the replacement, probably two times (username and password).
The name="" remains untouched and the size="10" needs to be changed only if your data string is larger than 10 chars.
In Topic ID 676, my Yahoo Form Filler, i needed to do that just once for the password.

So, hopefully correct this time :

Match = "(*type="text" name="USERNAME")1(*type="password" name="PASSWORD")23"
Replace = "1 value="My Username"2 value="My Password"3"
          "<script type="text/javascript">"
          "setTimeout('document.loginForm.submit()',300);</script>$STOP()"

HTH, sidki


 

[oltelman]

Guys, guys, guys, I did use my "REAL" username & password in the filter I'm using.  I changed it to post here.
My confusion started when I did not see the the "value" parameter in this code as I saw in the source for here (asp.flaaten.dk).

sidki:  I shall make the changes & let you know the outcome.

alto:  I consider the HTML method to be more secure & will try this after I get the filter to work.  I had tried opening your page with MS Word & it got confused.  Something about too many nest's.  I would have never thought a plain ol text editor would do the job.  I'm learning lots of new things today!

I am anxious to try these new words of wisdom, but I'm going fishing today!


 

[oltelman]

We have a winner.  A big thanks to one & all for your assistance.
It appears that "value" can be an implied parameter!
Ok, I'll push my luck with this. Sidki, how would this new info change your HTML page?

 

[sidki3003]

HTML page? Did you mix me up with altosax or JarC?

 

[oltelman]

My mistake & apologies!  It was altosax who was nice enough to put up an HTML page.
I think you answered my question though.  It lies in JarC's reply to me.
thanks again

Just one last question, today.  Do you people ever sleep???

 

[altosax]

quote:
Just one last question, today.  Do you people ever sleep???

now are the 4 am, i think i'll sleep from 4.30 to 11.00 am

just to let you choose,
if you don't like the type=hidden because the input fields disappear, you can restore the original type in the input tags, but set the value directly in the html code, as i suggested.

regards,
altosax.