Exploiting http services with squeak

Aaron J Reichow reic0024 at d.umn.edu
Thu Apr 12 00:24:06 UTC 2001


On Thu, 12 Apr 2001, Markus G[ISO-8859-1] dlli wrote:

> But how can one find out the parameters for a given http-service on the
> internet?
> [...]
> I want to connect to a chatterbot like
> http://www.hamill.co.uk/cgi-bin/hamill/mabel1/mabel.cgi
>
> Do I have to ask the hosts of the site or is there a more "generic"
> solution?

You can look within the HTML file.

For example, for this Mabel chatbot, we can do a search for a form tag,
and we find:

<form action="http://www.hamill.co.uk/cgi-bin/hamill/mabel1/mabel.cgi"
method="POST">
<input type="text" name="d" size="70" maxlength="300">
<input type="hidden" name="s"
value="6=,9(92+~;=0~+~5+~=0:~,/</*'=,9px{lfcV=,:8'=,9~2/(9~*w+~6)1=0+6=,9_x{lfcE9~2/(9~*,)9+~;=0~+~=0:~,/</*+9pppx{lfc|G6=*59Z/~%/)~<*,)9~6)1=0+/8*69_~]~,/+*p{LY[OHYL?NLYHUOIK?ZYRUHYLEx{lfcjidjkrlfdmirmgdhrfdmrgkdhrlfdnrjidmnrmldirx{lfcefgnkjhhgx{lfcli9/~=0:~T)250~=~0=19r~+'9~'/)2:~+~+19,~0=19~<%~=0%~/*p|~K6=39922~=+.9*522~+9r~L/19=,9">
</form>

This tells us that there are two fields:

d (of type text): contains the input for the bot.  It's the field into
which y ou are typing the inquiry when you're looking at the page in a
browser.

s (of type hidden): the big crazy hidden string is most likely a session
ID for keeping track of the conversation.

Looking at HTML source is usually enough, but I'm sure there are times
when it wouldn't be.

Aaron

Aaron Reichow  ::  Twin Ports ACM VP ::  http://www.d.umn.edu/~reic0024/
"The profit system follows the path of least resistance and following the
path of least resistance is what makes a river crooked." -U. Utah Phillips





More information about the Squeak-dev mailing list