We Keep Coding

How would I translate this html POST request into python

I am having difficulty translating this specific HTML POST request into Python - I am attempting to exploit a security vulnerability on a test server.
director=
<form action="http://127.0.0.1:8000/card/0" method="POST">
<input type="hidden" name="amount" value="8000" />
<input type="hidden" name="username" value="hacker" />
<input type="submit" value="View my photos" />
</form>

Before you run the code below. Run pip install requests.
import requests
response = requests.get("http://api.open-notify.org/astros.json")
print(response)
>>>> Response<200>
See more details in the URL below.
https://www.nylas.com/blog/use-python-requests-module-rest-apis/

How to login to a website using python and upload a file to s3?

I have a script that uploads a file from a public URL to S3 which is working fine. i have a need to use this script to upload some files which are not Public, i need to log in to the site to get the file. i need help implementing this in my script; where the script would log in to the site and get the file. site i am trying to login to https://catalog.ldc.upenn.edu/login
Here is my Script
import threading
import requests
import boto3
from boto3.s3.transfer import TransferConfig
def multi_part_upload_with_s3():
config = TransferConfig(multipart_threshold=1024 * 25, max_concurrency=30,
multipart_chunksize=1024 * 25, use_threads=True)
url = "www.example-url.com"
r = requests.get(url, stream=True)
session = boto3.Session()
s3 = session.resource('s3')
key = 'examplePath/file'
bucket = s3.Bucket(bucket_name)
bucket.upload_fileobj(r.raw, key, Config=config, Callback=None)
Here is the html from the site i need to log in to
<form class="new_spree_user" id="new_spree_user" action="/login" accept-charset="UTF-8" method="post"><input name="utf8" type="hidden" value="✓"><input type="hidden" name="authenticity_token" value="xjxGqf8OYqJd6Ynt1GcK1Ms0XM6YcPz3kS69TFKCCRQwOgwh1kEMlpJSTKAoblXLtLpSLCIiwPWT+LLab0Altw==">
<div id="password-credentials">
<p>
<label for="spree_user_email">E-mail</label><br>
<input class="title" tabindex="1" type="text" name="spree_user[login]" id="spree_user_login">
</p>
<p>
<label for="spree_user_password">Password</label><br>
<input class="title" tabindex="2" type="password" name="spree_user[password]" id="spree_user_password">
</p>
</div>
<p>
<input name="spree_user[remember_me]" type="hidden" value="0"><input type="checkbox" value="1" name="spree_user[remember_me]" id="spree_user_remember_me">
<label for="spree_user_remember_me">Remember me</label>
</p>
<p><input type="submit" name="commit" value="Login" class="button primary" tabindex="3" id="submit_form" data-disable-with="Login"></p>
</form>
or
Create a new account |
Forgot password?

Login a website using python script redirects at same page

i am trying to login into a website using python script having the 'form' tag like this in the source code.
<form action="trylogin.php" method="post">
<input name="authenticity_token" type="hidden" value="dpsTlD8zutj35FVWJTIqtUZGX67qQ/vab33hpPyYuaU=" />
<input id="user_username" maxlength="20" name="username" placeholder="Username" size="20" type="text" />
<input id="user_password" name="password" placeholder="Password" size="20" type="password" />
<input class="submit themed_bg themed-dark-hover-background" name="commit" type="submit" value="Login" />
</form>
and i am trying the following python code
import requests
import lxml
import lxml.html
s = requests.session()
login = s.get('url')
login_html = lxml.html.fromstring(login.text)
hidden_inputs = login_html.xpath(r'//form//input[#type="hidden"]')
form = {x.attrib["name"]: x.attrib["value"] for x in hidden_inputs}
form['username'] ='user'
form['password'] ='pass'
form['commit'] = 'Login'
response = s.post('url', data=form)
response.ok
response.url
s.get() is working fine and response.ok also gives 'true'output but url of response is same as of previous page. it seems like it is redirecting the same page. i can't login from python. What should i do Should i use header arguement in s.post()? how to know it? and i have used
form['commit'] = 'Login'
since login is in form of input not button, is it correct?
<input class="submit themed_bg themed-dark-hover-background" name="commit" type="submit" value="Login" />

Pass Python parameters to HTML

I've the following HTML code:
<html>
<form action="index.php" method="post">
Enter Input:
<input type="text" class="textbox" name="usn" id="usn" required />
<input class="buttongo" type="submit" value="Go" />
<input type="hidden" name="task" value="getResult"/>
</form>
</html>
I want to write a python script, which executes the above HTML, passing a value parameter to the first input statement to the above HTML. That is,
<html>
<form action="index.php" method="post">
Enter Input:
<input type="text" class="textbox" name="usn" id="usn" value="FromPython" />
<input class="buttongo" type="submit" value="Go" />
<input type="hidden" name="task" value="getResult"/>
</form>
</html>
Further, is there a way in which I can directly send the value to index.php and get the response?
(P.S.: I want to loop the value from 0 to 100 and save the response generated in a file)

Why don't you send the request using python ? You can send the requests inside a loop and pass the parameters you want.
Making requests with the requests module
sample code :
import requests
for i in range(101):
payload = {'usn': i}
response = requests.post("index.php", data=payload)
# do something with response

Use urllib module, documentation at: https://docs.python.org/2/library/urllib.html
As described in the link, this module provides a high-level interface for fetching data across the World Wide Web.

Logging into website with requests

I have this form, but I am not sure how to create the payload that will do this correctly.
<form method="post" action="/login" name="loginform" id="loginForm">
<fieldset id="fs">
<label for="username">Username:
<input type="text" id="username" name="username" />
</label>
<label for="password">Password:
<input type="password" id="password" name="password" />
</label>
<input type="hidden" name="act" value="login" />
<input name="submit" type="submit" id="submit" value="Login" />
</fieldset>
</form>
I tried doing payload = {"username":"blah","password":"blah"}; r=requests.post(url, data=payload) but I didn't get the response I was expecting; namely, r.text doesn't have the expected "Login failed" line in it.
But when I fill out the form and try to log in for the first time through a browser, it indicated that it was my second failed login.
The website I'm playing with in particular is www.thepiratebay.se, and what I'm working towards is being able to programmatically upload a torrent file.
---EDIT---
The new code I am using is
import requests
user = "username"
pswd = "password"
url = "http://www.thepiratebay.se/login"
payload = {
"act":"login",
"username":user,
"password":pswd,
"submit":"Login"
}
r = requests.post(url, data=payload, allow_redirects=True)
print r.text
Still not working! r.text is just the default login page. Anymore suggestions?

use firebug net tab to track down the actual sent parameters, this is what I got when I gave it a try:
act login
password password
submit Login
username username
Source
username=username&password=password&act=login&submit=Login

I ended up going with a different module, twill, to do what I wanted. I think twill is actually a 'full' web browser. Anyway, this is what the code turned into:
from twill import commands
commands.go("http://www.thepiratebay.se/login")
commands.form("loginform", "username", "blah")
commands.form("loginform", "password", "blah")
commands.submit()