使用CURL php和CSRF令牌登录

Question

我有一个这样的表单，我喜欢用curl登录php，每次运行代码时都会更改csrf。请帮助我做到这一点。

我的用户名：arasharash13721372

我的密码：123789

登录网址：http://www.parscoders.com/login

<form action="/login_check" method="post"> 
<input type="hidden" name="_csrf_token" value="NBGeQMmLr09KcrvwTCfDQhZSiLFy3XLODDsErdyBVUg" /> 
        <input type="hidden" name="_target_path" value="account" />     <div class="form-group"> 
         <label for="username">نام کاربری:</label> 
         <input class="form-control ltr monospace" type="text" id="username" name="_username" value="" /> 
        </div> 
        <div class="form-group"> 
         <label for="password">رمز عبور:</label> 
         <input class="form-control ltr" type="password" id="password" name="_password" /> 
        </div> 
        <div class="form-group"> 
         <div class="pull-right"> 
          <div class="checkbox"> 
           <label for="remember_me"> 
            <input type="checkbox" id="remember_me" name="_remember_me" value="on" /> 
            مرا به یاد بسپار</label> 
          </div> 
         </div> 
         <div class="pull-left checkbox"> 
          <a href="/resetting/request"> 
           بازنشانی رمز عبور 
          </a> 
         </div> 
         <div class="clear"></div> 
        </div> 
        <div class="form-group"> 
         <input type="submit" id="_submit" name="_submit" value="ورود" class="btn btn-primary btn-lg" /> 
        </div> 
       </form> 

Answer 1

根据上述描述 ，并假设你会从上面提到的形式发布数据，请尝试执行下面的代码片段在PHP的卷曲度进行登录操作。

$ _ POST超全局变量保存从表单提交的表单数据

$ch=curl_init(); 
$url='http://www.parscoders.com/login'; 
// $_POST=array('_csrf_token'=>'mikq09ufTuaO3aXMV4Xu-wJPnxm6t4DB1GTlnzf_BxA','_target_path'=>'account','_username'=>'arasharash13721372','_password'=>'123789','_submit'=>'ورود'); 
$fields_string=http_build_query($_POST); 
curl_setopt($ch,CURLOPT_URL, $url); 
curl_setopt($ch,CURLOPT_POST, 1); 
curl_setopt($ch,CURLOPT_POSTFIELDS, $fields_string); 
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true); 
curl_setopt($ch,CURLOPT_RETURNTRANSFER,1); 

//execute post 
$result = curl_exec($ch) or exit(curl_error($ch)); 
print_r($result); 

//close connection 
curl_close($ch); 

Answer 2

获取令牌是容易有点...我不读阿拉伯语所以它的棘手 - 你需要玩弄卷曲的一面，并且可能会掩盖你的用户名/密码。

<?php 
    error_reporting(E_ALL); 

    $url='http://www.parscoders.com/login'; 
    $field='_csrf_token'; 
    $csrftoken=false; 
    /* Grab the html so we can extract the token */ 
    $html=file_get_contents($url); 

    /* Create DOMDocument to parse the html */ 
    libxml_use_internal_errors(true); 
    $dom=new DOMDocument; 
    $dom->validateOnParse=false; 
    $dom->recover=true; 
    $dom->formatOutput=false; 
    $dom->loadHTML($html); 
    libxml_clear_errors(); 

    /* Use an XPath query to find the relevant info */ 
    $xpath=new DOMXPath($dom); 
    $col=$xpath->query('//input[@name="'.$field.'"]'); 
    foreach($col as $node) $csrftoken=$node->getAttribute('value'); 

    /* If you found the token, initialise curl */ 
    if($csrftoken){ 

     $params=array(
      $field   => $csrftoken, 
      '_target_path' => 'account', 
      '_username'  => 'arasharash13721372', 
      '_password'  => '123789', 
      '_remember_me' => 'on', 
      '_submit'  => 'ورود' 
     ); 

     $curl=curl_init($url); 

     curl_setopt($curl, CURLOPT_AUTOREFERER, true); 
     curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true); 
     curl_setopt($curl, CURLOPT_FRESH_CONNECT, true); 
     curl_setopt($curl, CURLOPT_FORBID_REUSE, true); 
     curl_setopt($curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1); 
     curl_setopt($curl, CURLOPT_CLOSEPOLICY, CURLCLOSEPOLICY_OLDEST); 
     curl_setopt($curl, CURLOPT_MAXCONNECTS, 1); 
     curl_setopt($curl, CURLOPT_FAILONERROR, true); 
     curl_setopt($curl, CURLOPT_HEADER, true); 
     curl_setopt($curl, CURLOPT_RETURNTRANSFER, true); 
     curl_setopt($curl, CURLOPT_CONNECTTIMEOUT, 15); 
     curl_setopt($curl, CURLOPT_TIMEOUT, 90); 
     curl_setopt($curl, CURLOPT_USERAGENT, 'Mozilla - login...'); 
     curl_setopt($curl, CURLINFO_HEADER_OUT, true); 

     curl_setopt($curl, CURLOPT_POST, true); 
     curl_setopt($curl, CURLOPT_POSTFIELDS, $params); 

     $payload=array_filter(array(
       'response' => curl_exec($curl), 
       'info'  => curl_getinfo($curl), 
       'errors' => curl_error($curl) 
      ) 
     ); 
     curl_close($curl); 

     print_r($payload); 
    } 

?>