Advertisement
Guest User

Untitled

a guest
Jan 17th, 2019
696
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.95 KB | None | 0 0
  1. Now lets assume after this you login into Google.com, now what your browser do is it sends a POST request, POST Basically can transfer data from you to the website and then the website returns something like "Login Successful" or redirect you to another homepage with your name on it etc. Now this POST request are usually in form of
  2.  
  3. username=demonx&password=mystrongpass&token=123123sdasd123212n128312i
  4.  
  5. Token: Token is basically a security made by website developers to stop bots like you from cracking accounts too easily. Not all websites have this but lets assume they do. Now, the above POST request
  6.  
  7. "username=demonx&password=mystrongpass&token=123123sdasd123212n128312i"
  8.  
  9. this is done by our browser automatically, now we want to send this exactly to google.com so it tells us if its correct or not. This is how we will do it in most cases.
  10.  
  11. username=&password=&token=+token|1+
  12.  
  13. Sometimes you wish to change the syntax of PostData meaning the Website wants Token first and after that password, how would you know this? As I said we are just going to clone the request and for that we will see what our browsers sends and clone it. Every browser have Developer tools/Inspect Element(Use Cntrl + SHIFT + I to open it). We are going to use that to see what happens when you put user and pass.
  14.  
  15. https://prnt.sc/je6wbw STEP 1
  16. https://prnt.sc/je6xsv STEP 2
  17. http://prntscr.com/je6yy0 STEP 3
  18.  
  19. Now you've seen the postData send to the website, here it is how we are going to set it in Snipr.
  20.  
  21. ORIGINAL:
  22.  
  23. login_form%5Bname%5D=my_email%40gmail.com&login_form%5Bpassword%5D=mystrongpass&login_form%5Bredirect_url%5D=%2F&login_form%5B_token%5D=vlHZXQ-IO-yW1JB9mWrXuySeGmafKSAs3iGLw76J_eU
  24.  
  25.  
  26. SNIPR:
  27. login_form%5Bname%5D=&login_form%5Bpassword%5D=&login_form%5Bredirect_url%5D=%2F&login_form%5B_token%5D=+token|1+
  28.  
  29. SNIPR CONFIG TEMPLATE
  30.  
  31. { \\ THIS IS GENERAL SECTION DEFINES NAME, PROXY ETC
  32. "General": {
  33. "name": "Config_name",
  34. "proxyType": "Proxies/Proxyless",
  35. "comboType": "Email/User",
  36. "credit": "Win32.exe"
  37. },
  38. "Requests": [ \\ REQUESTS SECTIONS WHERE ALL GET AND POST HAPPENS
  39. {
  40. "actionUrl": "POST METHOD USUALLY USED TO POST USER + PASSWORD + ANY TOKEN TO WEBSITE FOR AUTHENTICATION", \\ request 1
  41. "method": "POST",
  42. "contentType": "application\/json; charset=UTF-8", \\ THIS EXAMPLE USES A JSON SITE, REMOVE IF NOT JSON
  43. "postData": "{\"email\":\"<USER>\",\"password\":\"<PASS>\"}", \\ whenever you want " as a string you put \"
  44. "successKeys": [
  45. "{\"token\":",
  46. ""
  47. ],
  48. "failureKeys": [
  49. "Password does not match",
  50. "This account has been disabled.",
  51. "\"mfa\": true",
  52. "New login location detected",
  53.  
  54.  
  55. ],
  56. "regex": [ \\this site needs a token to put in headers
  57. {
  58. "name": "token",
  59. "pattern": "\"token\": \"([^\"]*)\"",
  60. "usedFor": "headers"
  61. }
  62.  
  63. ]
  64. }, \\ COMMA AFTER EVERY REQUEST HAS BEEN COMPLETED
  65. {
  66. "actionUrl": "This one is Get Method generally used to capture or get information after login or before login for token", \\request 2
  67. "method": "GET",
  68. "headers": [
  69. {
  70. "name": "Authorization",
  71. "value": "+token|1+"
  72. }
  73. ],
  74. "regex": [
  75. {
  76. "name": "billing",
  77. "pattern": "\"billing\": \"([^\"]*)\"",
  78. "usedFor": "capture"
  79. }
  80. ],
  81.  
  82. "successKeys": [
  83. "\"billing\":"
  84. ]
  85.  
  86. },
  87. {
  88. "actionUrl": "SOMETIMES YOU NEED MULTIPLE REQUESTS THIS ONE IS USED TO CAPTURE USERNAME IN THE ACCOUNT",\\ request:3
  89. "method": "GET",
  90. "headers": [ \\ sometimes you need custom things in headers like a token, this is how you use it
  91. {
  92. "name": "Authorization",
  93. "value": "+token|1+" \\ whenever you wish to use a regex/variable put it as +name|1+
  94. }
  95. ],
  96. "regex": [ \\another variable to store username
  97. {
  98. "name": "Cap",
  99. "pattern": "\"username\": \"([^\"]*)\"",
  100. "usedFor": "capture" \\ this one is used to capture
  101. }
  102. ],
  103.  
  104. "successKeys": [
  105. "\"username\":"
  106. ],
  107. "capture": [
  108. "Username - +Cap|1+ | Billing - +billing|1+" \\ this prints Username - "Our username Request 3" | BILLING - "Our Billing from Request 2"
  109.  
  110. ]
  111. }
  112. ]
  113. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement