Tuesday, March 17, 2020

Automated login with PHP and cURL


Using PHP and cURL to login to an account automatically can be quite useful. Sometimes I may need to access a user's information from another website to populate a form, facilitate a user sign up or to initiate some other feature. In this case when the user provides credentials I am able to use cURL with PHP to do an automated login to retrieve the user's information. 

In the simple login form I have created below to test out this script there is a username and password field at login1.php. Upon submitting the form, the process.php file handles the querying of the database and confirms whether or not a user is to be authenticated. Since here I am automating the process I can bypass the manual login1.php form and just send the $data array to the process handler file of process.php.




In this first screenshot below you can see the first page a visitor will arrive at. They will be first asked for a username and password.


In this process since I am skipping login1.php and going to process.php I wanted to show what happens if you just try to access the process.php file. You would see the error below which is telling you that there is an undefined index for the username and the password meaning the program doesn't know what to do without credentials.




Here is the interesting part, where I can use PHP with cURL to automate the process. The $data array is sent as a POST to the process.php file. Now when it runs with the credentials it logs in and reflects back that the testuser1 was able to successfully login with their username and password and this was all done in an automated fashion.

Logged in with PHP and cURL






No comments:

Post a Comment

Automated Exploitation of a Bluetooth vulnerability that leads to 0-click code execution

This blog post covers an interesting vulnerability that was just discovered earlier this year and an open source free tool that was created ...