Java Emulation Login Instance

Recently in the company of a Web project. Requirements on our system, the data on other sites can be displayed.

When I first started getting this mission, I was thinking. Simple and very. directly into the page with Urlconection, and then get the HTML of the page, take the desired data. Return to our system's front page and print it out.

I also thought of design patterns so that we could expand to see multiple pages in the future.

But. The idea is simple, really do when the idea of chaos ...

This page also has to log in ...

Then on the Internet to find the example of a simulated login. Check it out, the idea is this:

a) Add the account number and password to the request first.

Then log in

b) After logging in. Get a login cookie

c) Depending on the cookie you get, visit the address you want to go to.

The difference with the previous is. In the output stream. Add account name and password, code such as the following

StringBuffer sb = new StringBuffer ();  Sb.append ("email=" +usr);  Sb.append ("&password=" +pwd);  OutputStream OS = Connection.getoutputstream (); Os.write (Sb.tostring ());  

However, when running, the HTML returned is not a login page.

The cookie was not received because there was an error while logging in.

So the question is, which is the best place to log on to the Web page?

This email and password These two parameters, I use the HTML account number and the password element ID. Are these two parameter names right? Do these two have other values? Is this the right way?

And then continue to explore on the internet ...

The following code appears:

Package Com.task;import Java.util.arraylist;import Java.util.list;import org.apache.http.header;import Org.apache.http.httpresponse;import Org.apache.http.namevaluepair;import Org.apache.http.client.CookieStore; Import Org.apache.http.client.responsehandler;import Org.apache.http.client.entity.urlencodedformentity;import Org.apache.http.client.methods.httpget;import Org.apache.http.client.methods.httppost;import Org.apache.http.cookie.cookie;import Org.apache.http.impl.client.basicresponsehandler;import Org.apache.http.impl.client.defaulthttpclient;import Org.apache.http.message.basicnamevaluepair;import Org.apache.http.protocol.http;public class RenRen {//The configuration items private static String UserName = "Your account    Number ";    private static String password = "Your password";    private static String RedirectURL = "Http://jk.coolchuan.com/report/total-downloads";    Don ' t change the following URL private static String Renrenloginurl = "http://www.coolchuan.com/sign_in"; The HTTPCLient is used in one session private HttpResponse response;    Private Defaulthttpclient httpclient = new Defaulthttpclient ();        Private Boolean login () {HttpPost httpost = new HttpPost (Renrenloginurl);        All the parameters post to the Web site list<namevaluepair> Nvps = new arraylist<namevaluepair> ();        Nvps.add (New Basicnamevaluepair ("Redirect_uri", ""));        Nvps.add (New Basicnamevaluepair ("User[remember_me]", "1"));        Nvps.add (New Basicnamevaluepair ("User[email]", userName));        Nvps.add (New Basicnamevaluepair ("User[password]", password)); try {httpost.setentity (new urlencodedformentity (Nvps, HTTP).            Utf_8));            Response = Httpclient.execute (httpost);            Cookiestore Cookiestore = Httpclient.getcookiestore ();            list<cookie> cookies = cookiestore.getcookies ();            for (Cookie c:cookies) {System.out.println ("#############" +c); }} catch (Exception e) {e.printstacktrace ();        return false;        } finally {Httpost.abort ();    } return true;    } private String Getredirectlocation () {header[] headers = response.getallheaders ();    for (int i = 0; i < headers.length; i++) {System.out.println (headers[i]);        } Header Locationheader = Response.getfirstheader ("location");        if (Locationheader = = null) {return null;    } return Locationheader.getvalue ();        } private String GetText (String redirectlocation) {HttpGet httpget = new HttpGet (redirectlocation);        Create a response handler responsehandler<string> ResponseHandler = new Basicresponsehandler ();        String responsebody = "";        try {responsebody = Httpclient.execute (HttpGet, ResponseHandler);            } catch (Exception e) {e.printstacktrace ();        Responsebody = null;      } finally {Httpget.abort ();      Httpclient.getconnectionmanager (). Shutdown ();    } return responsebody;            } public void Printtext () {if (login ()) {///String redirectlocation = Getredirectlocation ();            if (RedirectURL! = null) {System.out.println (GetText (RedirectURL));        }}} public static void Main (string[] args) {RenRen RenRen = new RenRen ();    Renren.printtext (); }}

Line 27th, is the URL of the login, line 24th is the redirected URL, that is, after login I want to jump to the URL

Then the question comes again. Line 37th to 40th, account number, password Why do you write this? How come a Redirect_uri and User[remember_me]?

The students who have done the web are all clear. When submitting a request on the login page, the fact is to submit a form. Need to increase the number of references in the request, the background at the time of the connection. Depending on the number of references received. To infer. The number of parameters received is correct, and then returns to the foreground whether the login is successful.

Assuming success, then go to the successful jump page, assuming it is unsuccessful. is still the login page, prompting the message, "Login failed".

The name of the requested parameter is required to be viewed through the tool.

I recommend using Firefox's firebug.

The same Firebug Network Monitor is powerful, can view HTTP headers for httprequests requests, and so on. The detailed review process is given below:

1, open the Firefox browser, press F12 to open Firebug, open the Network tab (assuming the first time, you need to click on the "Start" button), click "Keep"

watermark/2/text/ahr0cdovl2jsb2cuy3nkbi5uzxqvdhl6dhr6eno=/font/5a6l5l2t/fontsize/400/fill/i0jbqkfcma==/ Dissolve/70/gravity/southeast ">

2, the Address bar to enter the URL of the page, here is the http://www.coolchuan.com/sign_in. Then click "Clear". Clear out the excess network requests

3, enter the account password. Then log in to view the network situation and locate the post request, for example by:

Haha, I want to take the number.

This parameter is the key point of the analog login. It seems that the initial assumptions are wrong.

Here also came out a very serious site of the vulnerability. Ask the students to find it by themselves, hey.

Java Emulation Login Instance