PHP CURL to ASPX page - php

Question

So i have been trying to get this working, however for the past 3 hours all i am still getting is the login page.
To start I have gone trough the source code of the page and gotten all the inputs and are listed below:
__EVENTTARGET
__EVENTARGUMENT
__VIEWSTATE
__EVENTVALIDATION
__VIEWSTATEGENERATOR
EditToken
sUserName
sPassword
sParentUID
hidIE11BugFix
The Code:
<?php
//Login url, if i hit the page without logging in it will ask for username, password, and key then then will go to the page i an looking for.
$url = "https://domain.com/7000/7000.aspx?filtertype=2";
$ckfile = tempnam("/tmp", "CURLCOOKIE");
$useragent = 'Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.342.3 Safari/533.2';
$username = "username";
$password = "password";
$key = "key";
$f = fopen('/tmp/log.txt', 'w'); // file to write request header for debug purpose
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_COOKIEFILE, $ckfile);
curl_setopt($ch, CURLOPT_COOKIEJAR, $ckfile);
//I have tried to toggle these but does not make a difference
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
$html = curl_exec($ch);
curl_close($ch);
preg_match('~<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="(.*?)" />~', $html, $viewstate);
preg_match('~<input type="hidden" name="__EVENTVALIDATION" id="__EVENTVALIDATION" value="(.*?)" />~', $html, $eventValidation);
preg_match('~<input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="(.*?)" />~', $html, $viewstategenerator);
preg_match('~<input type=\'hidden\' name=\'EditToken\' id=\'EditToken\' value =\'(.*?)\'/>~', $html, $edittoken);
$viewstate = $viewstate[1];
$eventValidation = $eventValidation[1];
$viewstategenerator = $viewstategenerator[1];
$edittoken = $edittoken[1];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, $ckfile);
curl_setopt($ch, CURLOPT_COOKIEFILE, $ckfile);
curl_setopt($ch, CURLOPT_HEADER, FALSE);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_REFERER, $url);
curl_setopt($ch, CURLOPT_VERBOSE, 1);
curl_setopt($ch, CURLOPT_STDERR, $f);
curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
// Collecting all POST fields
$postfields = array();
$postfields['__EVENTTARGET'] = "";
$postfields['__EVENTARGUMENT'] = "";
$postfields['__VIEWSTATE'] = $viewstate;
$postfields['__EVENTVALIDATION'] = $eventValidation;
$postfields['__VIEWSTATEGENERATOR'] = $viewstategenerator;
$postfields['EditToken'] = $edittoken;
$postfields['sUserName'] = $username;
$postfields['sPassword'] = $password;
$postfields['sParentUID'] = $key;
$postfields['hidIE11BugFix'] = "";
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $postfields);
$ret = curl_exec($ch); // Get result after login page.
print $ret;
?>
The log file: I am new to reading response codes i have googled around and i see a couple items that might be red flags but im not really sure.
* About to connect() to domain.com port 443 (#0)
* Trying 123.123.123.123... * connected
* Connected to domain.com (1123.123.123.123) port 443 (#0)
* warning: ignoring value of ssl.verifyhost
* skipping SSL peer certificate verification
* SSL connection using TLS_RSA_WITH_AES_256_CBC_SHA
* Server certificate:
* subject: CN=domain.com,OU=COMODO SSL,OU=Issued through Domain Neme E-PKI Manager,OU=Domain Control Validated
* start date: Dec 10 00:00:00 2015 GMT
* expire date: Jan 21 23:59:59 2018 GMT
* common name: domain.com
* issuer: CN=COMODO RSA Domain Validation Secure Server CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
> POST /7000/7000.aspx?filtertype=2 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.342.3 Safari/533.2
Host: domain.com
Accept: */*
Referer: https://domain.com/7000/7000.aspx?filtertype=2
Cookie: ASP.NET_SessionId=1j4tzm4gp15myudy4hgtc3ua; GRI%5FLOGIN=NextURL=%2f7000%2f7000.aspx%3ffiltertype%3d2
Content-Length: 5658
Expect: 100-continue
Content-Type: multipart/form-data; boundary=----------------------------4e03c9b32001
< HTTP/1.1 100 Continue
< HTTP/1.1 302 Found
< Cache-Control: private
< Content-Type: text/html; charset=utf-8
< Location: /Login_Entry.aspx
< X-dynaTrace: PT=19804;PA=-499723444;RS=VMS1/20160624103046_0.session;SP=VMS1;PS=-1294020462
< dynaTrace: PT=19804;PA=-499723444;RS=VMS1/20160624103046_0.session;SP=VMS1;PS=-1294020462
< X-dynaTrace: PT=19804;PA=-499723444;RS=VMS1/20160624103046_0.session;SP=VMS1;PS=-1294020462
< dynaTrace: PT=19804;PA=-499723444;RS=VMS1/20160624103046_0.session;SP=VMS1;PS=-1294020462
* Replaced cookie GRI%5FLOGIN="NextURL=%2f7000%2f7000.aspx%3ffiltertype%3d2" for domain domain.com, path /, expire 0
< Set-Cookie: GRI%5FLOGIN=NextURL=%2f7000%2f7000.aspx%3ffiltertype%3d2; path=/
* Replaced cookie ASP.NET_SessionId="" for domain domain.com, path /, expire 0
< Set-Cookie: ASP.NET_SessionId=; path=/
< X-dynaTrace: PT=19804;PA=-499723444;RS=VMS1/20160624103046_0.session;SP=VMS1;PS=-1294020462
< dynaTrace: PT=19804;PA=-499723444;RS=VMS1/20160624103046_0.session;SP=VMS1;PS=-1294020462
< X-U2: ATLVP1WEB02
< X-FRAME-OPTIONS: SAMEORIGIN
< Date: Sat, 25 Jun 2016 01:09:24 GMT
< Content-Length: 134
<
* Ignoring the response-body
* Connection #0 to host domain.com left intact
* Issue another request to this URL: 'https://domain.com/Login_Entry.aspx'
* Violate RFC 2616/10.3.3 and switch from POST to GET
* Re-using existing connection! (#0) with host domain.com
* Connected to domain.com (165.193.56.22) port 443 (#0)
> GET /Login_Entry.aspx HTTP/1.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.342.3 Safari/533.2
Host: domain.com
Accept: */*
Referer: https://domain.com/7000/7000.aspx?filtertype=2
Cookie: ASP.NET_SessionId=; GRI%5FLOGIN=NextURL=%2f7000%2f7000.aspx%3ffiltertype%3d2
< HTTP/1.1 200 OK
< Cache-Control: no-cache, no-store
< Pragma: no-cache
< Content-Type: text/html; charset=utf-8
< Expires: -1
< X-dynaTrace: PT=19807;PA=-499723444;RS=VMS1/20160624103046_0.session;SP=VMS1;PS=-1294020462
< dynaTrace: PT=19807;PA=-499723444;RS=VMS1/20160624103046_0.session;SP=VMS1;PS=-1294020462
* Replaced cookie ASP.NET_SessionId="hzfobhtjmshwj2w45yiyappm" for domain domain.com, path /, expire 0
< Set-Cookie: ASP.NET_SessionId=hzfobhtjmshwj2w45yiyappm; path=/; HttpOnly
< X-U2: ATLVP1WEB02
< X-FRAME-OPTIONS: SAMEORIGIN
< Date: Sat, 25 Jun 2016 01:09:24 GMT
< Content-Length: 23876
< Vary: Accept-Encoding
<
* Connection #0 to host domain.com left intact
* Closing connection #0
The cookie: Im not really sure if is important however if it helps.
# Netscape HTTP Cookie File
# http://curl.haxx.se/rfc/cookie_spec.html
# This file was generated by libcurl! Edit at your own risk.
domain.com FALSE / FALSE 0 GRI%5FLOGIN NextURL=%2f7000%2f7000.aspx%3ffiltertype%3d2
#HttpOnly_domain.com FALSE / FALSE 0 ASP.NET_SessionId hzfobhtjmshwj2w45yiyappm

Answer 1

Ok i figured it out,
The login page is:
https://domain.com/login_entry.aspx
Looking at the source code, the line:
<form method="POST" action="login_confirm.ashx" id="form1">
https://domain.com/login_confirm.ashx
I changed:
$url = "https://domain.com/7000/7000.aspx?filtertype=2";
To:
$url = "https://domain.com/login_confirm.ashx";
Now i am seeing that i want.
Im not sure if this should be obvious or not.