views:

47

answers:

1

I use software called DotNetPanel (DNP) and I'm modifying PHProxy to automatically log into the administration panels for me. I've done this for several other types of software - like cPanel - just fine using authentication headers or POST variables, but DNP uses something I'm not familiar with - ViewState.

  1. When I POST the user/pass data the page refreshes like nothing even happened.
  2. When I POST the user/pass/__VIEWSTATE data the page produces a http://support.microsoft.com/default.aspx?scid=kb;EN-US;323744 error.

Any ideas?

What is funny is if I write a javascript function to fill in the same information and the page and simulate a 'click' on the login button it works just fine.

+1  A: 

Try and find out exactly what's happening when you log-in normally (ie: what's being posted, cookies that are being set, authentication methods, etc.) and reproduce that with PHProxy or whatever. To see that information, try using a tool like LiveHTTPHeaders.

quantumSoup
I actually am using LiveHTTPHeaders and am reproducing the POST variables and path exactly as they're sent. I've also used wireshark just for kicks.
gnucom
@gnucom Since you are using wireshark, can you tell if there's a difference between what your browser sends and what your script sends?
quantumSoup
Have you tried understanding how ViewState works? Here's some documentation: http://msdn.microsoft.com/en-us/library/ms972976.aspx
quantumSoup
Okay, so it turns out I wasn't passing all of the headers exactly the same. Things like Keep-Alive and Accept-Encoding were required in order to get the IIS server to response correctly. Once I created the identical headers, the IIS server responded perfectly. Ergo, this had nothing to do with viewstate. Thanks for your suggestions.
gnucom