Simulating Internet Explorer with fsockopen

[lvi]

I tried to simulate Internet Explorer (using fsockopen) when logining to http://www.ftv.com/ftvclub/ftvclub_member.asp
login: [e-mail]
password: password
but nothing happened. Maybe somebody knows how to login this page with PHP (my code is below)

$content = urlencode('email=[e-mail]&password=password');
$length = strlen($content);
$put = "
POST http://www.ftv.com/ftvclub/login_finish.asp HTTP/1.0\r\n
Host: www.ftv.com\r\n
Referer: http://www.ftv.com/ftvclub/ftvclub_member.asp\r\n
Cookie: testCookie=test\r\n
Content-Type: application/x-www-form-urlencoded\r\n
Content-Length: $length\r\n
\r\n
$content
";
$fp = fsockopen ("www.ftv.com", 80);
fputs ($fp, $put);

[Weedpacket]

Assuming you're using "Internet Explorer" to mean "http client" (which is what I'm guessing from the absence of a User-Agent: header)....
Your request headers are probably mangled by the extra linebreaks

Cookie: testCookie=test\r\n
Content-Type: application/x-www-form-urlencoded\r\n

While you do have the "\r\n" CRLF sequence to end each line, you're immediately following it by another line break (which, depending on the system and edtior the script was last edited in could be \r, \n or \r\n). Those aren't ignored by PHP.

[lvi]

I do not mangle it with "\r\n", as this script works with ordinary pages (where a login is not required).

You can just take any link and check this with following code afterwards:

while (!feof($fp)) echo fgets ($fp,128);

[lvi]

I also tried the following function:

function sendToHost($host,$method,$path,$data,$useragent=0)
{
// Supply a default method of GET if the one passed was empty
if (empty($method)) {
$method = 'GET';
}
$method = strtoupper($method);
$fp = fsockopen($host, 80);
if ($method == 'GET') {
$path .= '?' . $data;
}
fputs($fp, "$method $path HTTP/1.1\r\n");
fputs($fp, "Host: $host\r\n");
fputs($fp,"Content-type: application/x-www-form- urlencoded\r\n");
fputs($fp, "Content-length: " . strlen($data) . "\r\n");
if ($useragent) {
fputs($fp, "User-Agent: MSIE\r\n");
}
fputs($fp, "Connection: close\r\n\r\n");
if ($method == 'POST') {
fputs($fp, $data);
}

while (!feof($fp)) {
    $buf .= fgets($fp,128);
}
fclose($fp);
return $buf;

}

$host = 'www.ftv.com';
$method = 'post';
$path = 'http://www.ftv.com/ftvclub/login_finish.asp';
$data = 'email=[e-mail]&password=password';
echo sendToHost($host,$method,$path,$data,$useragent=0);

As a result I received:
HTTP/1.1 100 Continue Server: Microsoft-IIS/5.0 Date: Wed, 28 Apr 2004 13:57:49 GMT HTTP/1.1 302 Object moved Server: Microsoft-IIS/5.0 Date: Wed, 28 Apr 2004 13:57:49 GMT Connection: close Location: ftvclub_member.asp Content-Length: 158 Content-Type: text/html Expires: Tue, 27 Apr 2004 13:57:49 GMT Set-Cookie: ASPSESSIONIDASSQRQCD=CDHNAMJDPEBGIGCCGIHCBNBI; path=/ Cache-control: private

How can I use this info to establish connection to scan the site with php code? Would be very thankful for any help.

[Sgarissta]

Why do it it sockets? Why not use curl ?

[Kudose]

I am pretty sure I read a little while back about this problem a few times. It seems as if Microsoft finally decided to fix a security vunerability. Meaning you cannot pass username and passwords in the manner in which you are anymore.

[Weedpacket]

If you're not prepared to do the http protocol work yourself (fsockopen only gives you the socket connection - how you use it is up to you), then you'd be better off going with Sgarissta's suggestion.

In particular, you then won't need to know that when the server sends a 302 Object moved response, you're supposed to take the URL it gives as the location of where the resource moved to, and send back a request for that.

If you do want to do the http yourself, the official reference is RFC2616.

Although I don't know whether or not cURL will keep track of the session ID cookie...