Filling out forms using HTTP requests

[syrl]

So I've been creating a lot of bots using the browser but would like to start building using http requests instead due to resource usage. I've read over the guide and have been looking over the traffic log but am having a hard time figuring out which get/post requests are needed for the form. I've looked for video examples but haven't found any on just utilizing http requests.

anyone willing to make a video on creating a bot that utilizes http requests to fill out a form, would be greatly appreciated.(or point me in the right direction)

 

[syrl]

@lokiys any thoughts on this? Would a python example video work in terms of how and what to pull?

 

[myndeswx]

The filling of the form itself only happens visually on the browser, 99% of the time individual clicks are not being sent to the server.
What you are looking for is 1 request that submits this form, it's going to be either POST or PUT request, if you want to check it on Chrome, open developer tools and select the Fetch/XHR column.

If you can test it on the project maker, make sure to have the traffic window open, and before clicking the submit button make sure to clear the log window so it's easier to find your request.
Right after you click on 'submit' look for a POST request in the log, double click it to inspect the request and see if your data is in there, if it looks good you can simply right click it and make a cube from that request.
Now the real fun part begins, you need to figure out what has to be sent in that request, sometimes the fields are easy to guess, sometimes not so much (in the example below you should first urldecode that text so it's easier to read).
The request headers also contains the information on how the server expects the data (urlencoded in this case), although it's JSON more frequently.

Most of the time there is some kind of security, like captchas, tokens and all kinds of funky stuff, but you might get through just using the cookies.
Good luck!

 

[syrl]

The filling of the form itself only happens visually on the browser, 99% of the time individual clicks are not being sent to the server.
What you are looking for is 1 request that submits this form, it's going to be either POST or PUT request, if you want to check it on Chrome, open developer tools and select the Fetch/XHR column.

If you can test it on the project maker, make sure to have the traffic window open, and before clicking the submit button make sure to clear the log window so it's easier to find your request.
Right after you click on 'submit' look for a POST request in the log, double click it to inspect the request and see if your data is in there, if it looks good you can simply right click it and make a cube from that request.
Now the real fun part begins, you need to figure out what has to be sent in that request, sometimes the fields are easy to guess, sometimes not so much (in the example below you should first urldecode that text so it's easier to read).
The request headers also contains the information on how the server expects the data (urlencoded in this case), although it's JSON more frequently.

Most of the time there is some kind of security, like captchas, tokens and all kinds of funky stuff, but you might get through just using the cookies.
Good luck!
Посмотреть вложение 110504

Thank you so much for this! I've been able to make some bots using http requests due to it! Do you have to include the get request for the site before the post request or is that not needed?

 

[myndeswx]

Thank you so much for this! I've been able to make some bots using http requests due to it! Do you have to include the get request for the site before the post request or is that not needed?

I'm happy to help!
It really depends. You would make a GET request to get either the cookies for the POST request, OR there is some hidden value in the page source that must be used in the POST request.

For example, looking at my previous GIF, you can see there is this 'authenticity_token', I would think that it is hidden somewhere on the page when you first open the form.
So in this case you would first make the GET request, regex the 'authenticity_token' and then do the POST.

There's also a scenario where you would just load in the cookies from the profile/variable and use those for many POST requests, an example would be loading up an Instagram profile that's already logged in, and making a POST request to make a follow/like.