0

For my school, we have to do these "Advisory Lessons" that tell you about College, etc. After completing the lesson, I am wondering if I would be able to replicate the same process using a set of requests from a PHP script with cURL.

I went through the lesson again, this time with Firebug on and an HTTP Analyzer.

Much to my surprise, the only GET requests were sent out during the entire lesson.

In case your curious, here is what the "Lesson" window looks like. It's sort of powerpoint-type thing where you read the slide and then some slides have questions on them. At the end, there is a quiz and if you don't pass it, the lesson doesn't count.

My question is this: If I were to setup a PHP/cURL script that logged into my account, and then made every single one of those requests, would the lesson be counted as complete?

Now obviously it's impossible for you guys to know how their server works and such...

I guess what I am saying is, is there any hidden content or fields that you can pass through a GET request? It just doesn't seem like the lesson window is passing enough info to the server for it to know if the lesson was complete or not.

Thanks so much for any advice and tips on my project!

EDIT: Here is my official test run (please don't do it too many times):

As many of you hinted, it did not work....but I am still not completely sure why.

2
  • Why don't you just try it? Chances are it won't work because of cookies, but maybe it is as simple as that.
    – flagoworld
    Jul 25, 2012 at 7:33
  • But I am storing cookies with cURL...
    – kmoney12
    Jul 25, 2012 at 19:30

4 Answers 4

0

Like you say, we can't speak to the details of their server, but it is possible to do these kinds of things with GET requests only because servers can use cookies and store state (associated with these cookies) on the server.

This gives the appearance, probably, of passing extra hidden information to the server.

You can research cookies, and even that jsessionid thing that is appearing in their URLs. That BTW tips you off that they are using at least some Java. :)

1
  • I can grab the jsessionid though and get that right, because it's in the source code on the homepage (after the login). Is having a cookiejar in cURL enough? And what do you mean, passing "hidden information to the server". Is there anyway to pick up on this info?
    – kmoney12
    Jul 25, 2012 at 20:04
0

The lesson application may very well be storing data in a session or some other persistant data store server-side and using a token from your browser (usually a cookie or a GET parameter) to look up that data when needed.

0

Its a kinda complicated task. With only cURL you can't emulate execution of javascript code, AJAX requests etc

8
  • I know that, but does that matter? Javascript is only client side, except for the AJAX requests, but those AJAX requests are the things that the analyzer picks up. Those GET requests are from the AJAx.
    – kmoney12
    Jul 25, 2012 at 19:26
  • you have to know what to send. curl just grab html as plain text and all you can do is parse it and send requests. curl can't do it Jul 25, 2012 at 19:30
  • I still don't understand what you mean? If I have an HTTP analyzer on, then ANY contact between my lesson window and the server should be picked up, right?
    – kmoney12
    Jul 25, 2012 at 20:01
  • picked up how? you said I am wondering if I would be able to replicate the same process using a set of requests from a PHP script with cURL and the answer is no. but maybe i do not understand something Jul 25, 2012 at 20:04
  • What I am asking is this: Is it possible to communicate with a server without web-requests? Because the HTTP Analyzer should log every single request made from my computer to the server. The point isn't so much as to replicate the process as it is to trick the server into thinking that I have completed the lesson. If the only communication that my computer and the server has is those GET requests, can't I just replicate all of them with cURL?
    – kmoney12
    Jul 25, 2012 at 20:08
0

I am not sure what you are trying to do. For one HTTP is stateless protocol meaning the server gets request and gives a response to that particular request (that might be GET, POST or whatever and might have some request parameters). Statefullness in system usage is usually achieved by server creating a session and setting up a cookie on client side to pass session id in later requests. Session id is used to recognize the client and track his session. Everything you send during request is plain text. What response you get most likely will depend on session state and will also be a plain text. There is nothing hidden on a client side about client side. You just don't get to know what information server keeps in session and how requests are processed based on that and information you give during requests.

2
  • so if I replicate the reqests exactly, with the same cookies, shouldn't the server handle the cURL the same way it handled me actually taking the lesson?
    – kmoney12
    Jul 29, 2012 at 0:11
  • It does not matter what the client is, just the information sent (requests) to the server ...and probably the sequence of those requests.
    – Aidas
    Aug 6, 2012 at 12:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.