[Vultra]

Hello all,

My mate just create a website and so, he has just got a mailing server finished that is coded in PHP. When you want updates via that box on his website, it alerts him. I'm thinking of creating a python script that floods him emails for the looools. So, I've done some searching and, I need clues for this to work out. I'm not interested in showing code, just simple hints so, I can start from that and work it out myself. I do though need the correct modules.

Hope to hear the suggestions and hints .

- Mimi

[psightz]

Mouse recorder, copy paste your issue.
Does it require captcha?
burp suite replay the packet? Send the update request over and over.

[Vultra]

Mouse recorder, copy paste your issue.
Does it require captcha?
burp suite replay the packet? Send the update request over and over.

No captcha

[obnoxious]

So you simply want to fill in the message box on his site and hit send or am I misunderstanding? If that's the case you could either use selenium and select it by id or something, or a more clean approach would be to use the requests library. Both of the libraries mentioned above are pretty straightforward to use.

If you're going for the requests approach you would do something similiar to this

Code:

import urllib import requests session = requests.Session() # Encode the data before we post it payload = urllib.urlencode({    "some_key": 123,    "hello": "world!", }) session.post( "http://someurl.com", data=payload )

[Vultra]

So you simply want to fill in the message box on his site and hit send or am I misunderstanding? If that's the case you could either use selenium and select it by id or something, or a more clean approach would be to use the requests library. Both of the libraries mentioned above are pretty straightforward to use.

If you're going for the requests approach you would do something similiar to this

Code:

import urllib import requests session = requests.Session() # Encode the data before we post it payload = urllib.urlencode({    "some_key": 123,    "hello": "world!", }) session.post( "http://someurl.com", data=payload )

It has one of those "Enter your email to keep up to date" but, since he reconfigured the php, all emails redirect to him. So, if you were to pull this off, he would get flooded with emails.

[obnoxious]

So you simply want to fill in the message box on his site and hit send or am I misunderstanding? If that's the case you could either use selenium and select it by id or something, or a more clean approach would be to use the requests library. Both of the libraries mentioned above are pretty straightforward to use.

If you're going for the requests approach you would do something similiar to this

Code:

import urllib import requests session = requests.Session() # Encode the data before we post it payload = urllib.urlencode({    "some_key": 123,    "hello": "world!", }) session.post( "http://someurl.com", data=payload )

It has one of those "Enter your email to keep up to date" but, since he reconfigured the php, all emails redirect to him. So, if you were to pull this off, he would get flooded with emails.

Sorry for the late reply, is it basically a form that once pressed submits data to a php file? If so then you can accomplish it with doing what I showed above, but if it instead triggers a javascript function that does something you'd need to actually "act as a browser" so that you could click the button. In cases like these I use selenium with PhantomJS since I want a headless browser.

To summarize, the requests library can't actually click a button and skips that step and directly submits the data, if you actually want or need to click the button you would have to use something like selenium instead.
Always check the HTML code first to determine which one you should use, I always prefeer to not use selenium since it can often be much slower and in your case you would probably want it to be as fast as possible.

Has he set up any protection against how many times a certain IP can submit their email? If so use proxies, and if not you could atleast use one proxy if you don't want him to know it's you.

Code:

// Set up the proxies in a simple dictionary proxies = {    "http": "127.0.0.1:8080",    "https": "127.0.0.1:8080", } // Example data payload = urllib.urlencode({    "username": "Admin",    "password": "passw0rd123", }) // Fetching a page using the proxy defined above session.get( "http://someurl.com", proxies=proxies ) // Posting to a page using the proxy defined above session.post( "http://someurl.com?login.php", data=payload, proxies=proxies )