Galarzaa90 / NabBot

Discord bot for Tibia servers
https://nabbot.xyz
Apache License 2.0
52 stars 25 forks source link

http query using tokens #71

Closed Kuhicop closed 6 years ago

Kuhicop commented 6 years ago

Hello I'm trying to figure out how to make this work in Medivia.

This is the request on Medivia, from Burp Suite Free.

`POST /community/character HTTP/1.1

Host: medivia.online User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: https://medivia.online/community/character

Cookie: XSRF-TOKEN=eyJpdiI6ImpkVlRaTjg4UDlPMkJXRDQ4TzdNZUE9PSIsInZhbHVlIjoiVHFaUEE0bk05WSs2TVA5MUR4djQ4SHJmb0J6UWE2dE1sbEhcL3FwNjhyNVJOdXc1eHlSZHpMeHhGRGJZdkMzNnE3NlwvRU1NXC9OWVk5ZlhBWEF6QURya2c9PSIsIm1hYyI6ImMwMDc3MWNlOWQ1ZDgwZWQyNTg0MTdmOWMwNWRjMmUzMTJiNDZmOGJhZmMzZjE3ODA1NmE0NzEyYjVlYzUzZTAifQ%3D%3D; medivia_session=eyJpdiI6Im5WaXlUZ0NKZFA0NlF4S3lmM3FmRGc9PSIsInZhbHVlIjoiY1FQUUZRMzlGYnY1ZHBTdDE2RituVDg3V241Skd4Z0d3WXFXWmtFSUt0RjZPeGZqOU5JM2wwYkUraytuSnlScnVpVENzUllFQ1V1WjM5d1BrNmNieEE9PSIsIm1hYyI6IjU5MzEwODcyZWFjYTM2ZmQxN2MzNGIxYjRjZmZiYzc1NzBiZmE4MTNlZWQ4YWY3MjZjNjdiNDA1NDA2ODY1ZmYifQ%3D%3D

Connection: close Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded Content-Length: 62

_token=tK1ZXooJndaboQIzWKA0kmeMIbapAkGw3AHXnDop&name=nuevo+nai`

I don't know how to query this in the web browser, just in the same url...

I saw for Tibia it's simple https://secure.tibia.com/community/?subtopic=characters&name= Then you add the character name at the end, and you're done with the request!

Tomorrow I will check if token has date of expiry or we can use the same token for all requests like this one. I think that won't be a problem because I'm using it from Windows and Linux without trouble and also using anonymous session.

I hope someone can help! Thanks <3!

Galarzaa90 commented 6 years ago

It's not a matter of just changing the URL, the whole source of medivia character pages are different so yo would have to completely rewrite the get_character() function.

It has nothing to do with tokens, that's just your cookies for the website.