使用CURL php和CSRF令牌登錄

Question

我有一個這樣的表單，我喜歡用curl登錄php，每次運行代碼時都會更改csrf。請幫助我做到這一點。

我的用戶名：arasharash13721372

我的密碼：123789

登錄網址：http://www.parscoders.com/login

<form action="/login_check" method="post"> 
<input type="hidden" name="_csrf_token" value="NBGeQMmLr09KcrvwTCfDQhZSiLFy3XLODDsErdyBVUg" /> 
        <input type="hidden" name="_target_path" value="account" />     <div class="form-group"> 
         <label for="username">نام کاربری:</label> 
         <input class="form-control ltr monospace" type="text" id="username" name="_username" value="" /> 
        </div> 
        <div class="form-group"> 
         <label for="password">رمز عبور:</label> 
         <input class="form-control ltr" type="password" id="password" name="_password" /> 
        </div> 
        <div class="form-group"> 
         <div class="pull-right"> 
          <div class="checkbox"> 
           <label for="remember_me"> 
            <input type="checkbox" id="remember_me" name="_remember_me" value="on" /> 
            مرا به یاد بسپار</label> 
          </div> 
         </div> 
         <div class="pull-left checkbox"> 
          <a href="/resetting/request"> 
           بازنشانی رمز عبور 
          </a> 
         </div> 
         <div class="clear"></div> 
        </div> 
        <div class="form-group"> 
         <input type="submit" id="_submit" name="_submit" value="ورود" class="btn btn-primary btn-lg" /> 
        </div> 
       </form> 

Answer 1

根據上述描述 ，並假設你會從上面提到的形式發佈數據，請嘗試執行下面的代碼片段在PHP的捲曲度進行登錄操作。

$ _ POST超全局變量保存從表單提交的表單數據

$ch=curl_init(); 
$url='http://www.parscoders.com/login'; 
// $_POST=array('_csrf_token'=>'mikq09ufTuaO3aXMV4Xu-wJPnxm6t4DB1GTlnzf_BxA','_target_path'=>'account','_username'=>'arasharash13721372','_password'=>'123789','_submit'=>'ورود'); 
$fields_string=http_build_query($_POST); 
curl_setopt($ch,CURLOPT_URL, $url); 
curl_setopt($ch,CURLOPT_POST, 1); 
curl_setopt($ch,CURLOPT_POSTFIELDS, $fields_string); 
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true); 
curl_setopt($ch,CURLOPT_RETURNTRANSFER,1); 

//execute post 
$result = curl_exec($ch) or exit(curl_error($ch)); 
print_r($result); 

//close connection 
curl_close($ch); 

Answer 2

獲取令牌是容易有點...我不讀阿拉伯語所以它的棘手 - 你需要玩弄捲曲的一面，並且可能會掩蓋你的用戶名/密碼。

<?php 
    error_reporting(E_ALL); 

    $url='http://www.parscoders.com/login'; 
    $field='_csrf_token'; 
    $csrftoken=false; 
    /* Grab the html so we can extract the token */ 
    $html=file_get_contents($url); 

    /* Create DOMDocument to parse the html */ 
    libxml_use_internal_errors(true); 
    $dom=new DOMDocument; 
    $dom->validateOnParse=false; 
    $dom->recover=true; 
    $dom->formatOutput=false; 
    $dom->loadHTML($html); 
    libxml_clear_errors(); 

    /* Use an XPath query to find the relevant info */ 
    $xpath=new DOMXPath($dom); 
    $col=$xpath->query('//input[@name="'.$field.'"]'); 
    foreach($col as $node) $csrftoken=$node->getAttribute('value'); 

    /* If you found the token, initialise curl */ 
    if($csrftoken){ 

     $params=array(
      $field   => $csrftoken, 
      '_target_path' => 'account', 
      '_username'  => 'arasharash13721372', 
      '_password'  => '123789', 
      '_remember_me' => 'on', 
      '_submit'  => 'ورود' 
     ); 

     $curl=curl_init($url); 

     curl_setopt($curl, CURLOPT_AUTOREFERER, true); 
     curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true); 
     curl_setopt($curl, CURLOPT_FRESH_CONNECT, true); 
     curl_setopt($curl, CURLOPT_FORBID_REUSE, true); 
     curl_setopt($curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1); 
     curl_setopt($curl, CURLOPT_CLOSEPOLICY, CURLCLOSEPOLICY_OLDEST); 
     curl_setopt($curl, CURLOPT_MAXCONNECTS, 1); 
     curl_setopt($curl, CURLOPT_FAILONERROR, true); 
     curl_setopt($curl, CURLOPT_HEADER, true); 
     curl_setopt($curl, CURLOPT_RETURNTRANSFER, true); 
     curl_setopt($curl, CURLOPT_CONNECTTIMEOUT, 15); 
     curl_setopt($curl, CURLOPT_TIMEOUT, 90); 
     curl_setopt($curl, CURLOPT_USERAGENT, 'Mozilla - login...'); 
     curl_setopt($curl, CURLINFO_HEADER_OUT, true); 

     curl_setopt($curl, CURLOPT_POST, true); 
     curl_setopt($curl, CURLOPT_POSTFIELDS, $params); 

     $payload=array_filter(array(
       'response' => curl_exec($curl), 
       'info'  => curl_getinfo($curl), 
       'errors' => curl_error($curl) 
      ) 
     ); 
     curl_close($curl); 

     print_r($payload); 
    } 

?>