Problem login in an aspx page

[Alberto]

Hi, I´m trying to login to a aspx site to read some pages.
Its a https site.

First I use Fb and fiddler to catch the post string needed.

Then I use the Nettalk Client DEMO to try to connect.

-Address tab, https://inversor.bullmarket.com.ar/log.aspx
-Go Fetch, and the page comes ok
-Nead the end you can see:
          <input name="txus" type="text" value="7088" id="txus" class="txt" />
          <input name="txpa" type="password" id="txpa" class="txt" />
which are the user and pass input fields

-Go to Generic Post Tab
-Paste the fiddler post string:
__EVENTTARGET=btin&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwUKLTk4MTc5NzMxOA9kFggCAQ9kFgQCBw8PFgIeB1Zp2FcTplxC%2BP7cIE%2B%2Bu%2F9hd1wQ%3D%3D&__EVENTVALIDATION=%2FwEWBQK21pnQDQKt79HdCwKm4aT3DgKLlL3HBALUs8w0ag4TeRClzvN3GdPFggu9vZYq5nM%3D&txus=7088&txpa=WiPASS&btin.x=58&btin.y=10

And it does not log in, the same login page is returned.

May be the problem is with the _VIEWSTATE and the _EVENTVALIDATION because if I chenge or delete them I get an error page.

What am I doing wrong or how can I solve it?
THanks
Alberto

     

[Bruce]

The WebClient in NT5 has a couple things that make this easier.

a) Turn on autoCookies.
This means that any "cookie" you get doing a fetch, will be returned to the server with your next request. ie mimicing how a browser works.
ThisClient.OptionAutoCookie = 1

b) you can more easily mimic the Values submitted by a post by using the SetValue method. For example
ThisClient.SetValue('txus','7088')

See the Web Client "Weather" example.

cheers
Bruce

[Alberto]

Thanks Bruce but this is not the problem.
I am using ThisClient.OptionAutoCookie = 1
Theres no problem with cookies.

The problem is with the _VIEWSTATE and the _EVENTVALIDATION that aspx uses from page to page.

I´ve tryed everything.

I cant post the password here because this is a market site.
If you allow me I could send the data to connect to your mail for you to test ir.

Thanks
Alberto

[Bruce]

the Viewstate and Event fields appear to be encoded using "url encoding" sometimes called "escape encoding".
this is where non-alphabet chars are encoded as %xx where xx is a 2 digit hex number.

There is a method in the web client for decoding these strings, called .DecodeWebString.

for example;

viewstate = thisclient.DecodeWebString(viewstate)

[Alberto]

I´m not a good english writer and may be you are not understanding my problem.
But, just to investigate I´ve tryed to translate the viewstate as you said and that function does nothing with it.

with this argument:
/wEWBQKJ/5+sBQKt79HdCwKm4aT3DgKLlL3HBALUs8w0c2bLfCD1E8jh704PZQgR008LqCU=

it returns the same.

Alberto

[Bruce]

are you constructing the Post data by hand, or are you using the SetValue approach?

ViewState etc are fields you'd want to set with SetValue.

If you don't make any progress email me the login details and I'll try from here.

cheers
Bruce

[Alberto]

Differences between explorer post and exmaple post:

This is the POST capture with Fiddler, it works loggin in OK

POST /log.aspx HTTP/1.1
Host: inversor.bullmarket.com.ar
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; es-AR; rv:1.9.2.16) Gecko/20110319 Firefox/3.6.16 ( .NET CLR 3.5.30729; .NET4.0C)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-ar,es;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://inversor.bullmarket.com.ar/log.aspx
Cookie: ASP.NET_SessionId=njtkurfkva5tbqbzbvxkl1f2
Content-Type: application/x-www-form-urlencoded
Content-Length: 529
__EVENTTARGET=btin&__EVENTARGUMENT=&__VIEWSTATE=#vs1#&__EVENTVALIDATION=#ev1#&txus=7088&txpa=********&btin.x=64&btin.y=13

And this is the post sent by the Wheather example, copied from the Loggin tab

POST /log.aspx HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Host: inversor.bullmarket.com.ar
Content-Length: 515
Cookie: ASP.NET_SessionId=obce5i550q4yaf55dqiam255;
Connection: Close
__EVENTTARGET=btin&__EVENTARGUMENT=&__VIEWSTATE=#vs2#&__EVENTVALIDATION=#ev2#&txus=7088&txpa=*********&btin.x=58&btin.y=10

If I use the viewstate and eventvalidation used by the explorer, and use it with the example, then the login is rejected and you get the same loggin page.

Doing a GET of the loggin page with the example, you get another viewstate and eventvalidation in the data received, if I use this to try to loggin, I get an error page instead.

Any other idea?

[Alberto]

Bruce,
Did you recieved my email with the credentials?
This is a great problem for me.
I said to the customer I could do it!
Thanks
Alberto

[Bruce]

yes, I've got it Alberto. It's been the Easter holidays here (actually today is still a holiday here...)
I'll let you know as soon as I know something.

cheers
Bruce

[Bruce]

>> See the Web Client "Weather" example.

Run the Weather example.
Click on the Drive button
Enter
https://inversor.bullmarket.com.ar/log.aspx
into the URL, and click the Fetch button.

Now inspect the "Response" tab. This is the "login page".
On the cookies tab are the cookies received, and on the View Fields tab are the fields that are inside the <form> tag.

Set the value for the txus field to your "login" (and press save)
then set the txpa field to your password (and press save).

Now on the Post tab you can "post" the form by entering the URL;
https://inversor.bullmarket.com.ar/log.aspx

Now if you check the response you'll see that the page that comes back indicates you are logged in.

Cheers
Bruce

[Alberto]

Bruce,
I dont have xFiles, so I need to comment all the code that work with it.
So, I dont see the Fields, etc
Any other way I can do it?

THanks
Alberto

[Alberto]

I`ve tried adding the fields manually with the save button
but when I go to the Response tab, it shows the same initial page, without loggin in
What am I doing wrong?

[Bruce]

perhaps post your modified example here (the one without xfiles) and I'll see what effect I get.
I don't think xFiles is used too much in the "drive" procedure.

cheers
Bruce

[Alberto]

Attached (7.3 version)
This is the page where you are redirected when you are login in:
https://inversor.bullmarket.com.ar/Especifico/prin.htm?MENU1.HTM
I´m in a hurry with my customer...
Thanks

[attachment deleted by admin]

[Bruce]

sorry - it needs xFiles to parse the incoming HTML to find all the form fields.
You can of course parse the fields by hand - but I guess that will take a bit of work.

Cheers
Bruce