Mar 02 2020 08:11 AM
Hi, I'm trying to automate the request of a web page protected by a password. When I post the login form with the password, I expect to find the authentication cookie set by the website to be included in the session variable, so that I can request the protected page by passing the cookie. However, in the response to the POST, there are no cookies. I must be overlooking something obvious ?
When I inspect the browser conversation, the response to the POST contains the following header:
Set-Cookie: AuthCookie=e8b931f20709701 ... etc ... ; path=/; httponly;
$header1 = @{
'Host'="$($ip)"
'User-Agent'= 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36 Edg/80.0.361.62'
'Accept'= 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9'
'Accept-Language'= 'en-GB,en;q=0.9,en-US;q=0.8,fr;q=0.7,nl;q=0.6,af;q=0.5'
'Accept-Encoding'= 'gzip, deflate'
'Content-Type'='application/x-www-form-urlencoded'
'Referer'="$($url1)"
}
$login = Invoke-WebRequest $url1 -SessionVariable ws
$login.Forms[0].Fields.LogBox = $pwd
$page = Invoke-WebRequest $url1 -Body $login.Forms[0].Fields -Method Post -Headers $header1 -WebSession $ws
$page.Headers
$ws.Cookies.GetCookies($url1)
Mar 02 2020 12:45 PM - edited Mar 02 2020 12:46 PM
Hello,
have you tried the example 6 from the Powershell help for Invoke-Webrequest( https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-webrequest?vi... )?
May that will help you ;)
br,
Nico
Mar 03 2020 10:09 AM
Thansk for your time and effort @Nico_G
I checked that example, and it talks about multipart/form-data post submission, but that is not what the server is expecting, it just needs a simple application/x-www-form-urlencoded. Below I include the traffic that is exchanged. The issue I have is that when I do it programmatically, the cookie is missing from the post's response.
General
Request URL: http://10.0.2.49/general/status.html
Request Method: POST
Status Code: 301 Moved Permanently
Remote Address: 10.0.2.49:80
Referrer Policy: no-referrer-when-downgrade
Response Headers
Cache-Control: no-cache
Connection: close
Content-Language: en-gb
Content-Length: 9705
Content-Type: text/html
Location: /general/status.html
Pragma: no-cache
Server: debut/1.30
Set-Cookie: AuthCookie=e8b931f207097012850e8afdecace8a7:JWlbdmN8MrhkZCsRxhIPWYu7HH86yGgEAA%3D%3D; path=/; httponly;
X-Frame-Options: DENY
Request Headers
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en;q=0.9,en-US;q=0.8,fr;q=0.7,nl;q=0.6,af;q=0.5
Cache-Control: max-age=0
Connection: keep-alive
Content-Length: 101
Content-Type: application/x-www-form-urlencoded
Host: 10.0.2.49
Origin: http://10.0.2.49
Referer: http://10.0.2.49/general/status.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36 Edg/80.0.361.62
Form Data
CSRFToken: cmsr3WdzCu+xd1rW3SW1ZWemTfk6OQAoAA==
B133c: *** the password ***
loginurl: /general/status.html