Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been trying to find a python code that would log in to my mail box on from "Google App Engine". I was given this code:

import urllib, urllib2, cookielib

url = ""
form_data = {'login' : 'my-login-here', 'passwd' : 'my-password-here'}

jar = cookielib.CookieJar()
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(jar))
form_data = urllib.urlencode(form_data)
# data returned from this pages contains redirection
resp =, form_data)
# yahoo redirects to, so lets go there instead
resp ='')

The author of this script looked into HTML script of yahoo log-in form and came up with this script.

That log-in form contains two fields, one for users' Yahoo! ID and another one is for users' password.

However, when I tried this code out (substituting mu real Yahoo login for 'my-login-here' and my real password for 'my-password-here'), it just return the log-in form back to me, which means that something didn't work right.

Another supporter suggested that I should send an MD5 hash of my password, rather than a plain password.

He also noted that in that log-in form there are a lot other hidden fields besides login and password fields (he called them "CSRF protections") that I would also have to deal with:

<input type="hidden" name=".tries" value="1"> 
<input type="hidden" name=".src" value="ym"> 
<input type="hidden" name=".md5" value=""> 
<input type="hidden" name=".hash" value=""> 
<input type="hidden" name=".js" value=""> 
<input type="hidden" name=".last" value=""> 
<input type="hidden" name="promo" value=""> 
<input type="hidden" name=".intl" value="us"> 
<input type="hidden" name=".bypass" value=""> 
<input type="hidden" name=".partner" value=""> 
<input type="hidden" name=".u" value="bd5tdpd5rf2pg"> 
<input type="hidden" name=".v" value="0"> 
<input type="hidden" name=".challenge" value="5qUiIPGVFzRZ2BHhvtdGXoehfiOj"> 
<input type="hidden" name=".yplus" value=""> 
<input type="hidden" name=".emailCode" value=""> 
<input type="hidden" name="pkg" value=""> 
<input type="hidden" name="stepid" value=""> 
<input type="hidden" name=".ev" value=""> 
<input type="hidden" name="hasMsgr" value="0"> 
<input type="hidden" name=".chkP" value="Y"> 
<input type="hidden" name=".done" value=""> 

He said that I should do the following:

  1. Simulate normal login and save login page that I get;
  2. Save POST&GET headers with "Wireshark";
  3. Compare login page with those headers and see what fields I need to include with my request;

I really don't know how to carry out the first two of these three steps. I have just downloaded "Wireshark" and have tried capturing some packets there. However, I don't know how to "simulate normal login and save the login page". Also, I don't how to save POST$GET headers with "Wireshark". Can anyone, please, guide me through these two steps in "Wireshark"? Or at least tell me what I should start with. Thank You.

share|improve this question
Stop reposting this question every other hour. – random Apr 9 '10 at 4:02
random, please take note that all the questions that I have posted so far are different. For example, on SO I asked a question about what a header is, and this present question is about how to use "Wireshark" to get POST&GET headers. This one I have accidentally re-posted only once and wanted to delete the twin as soon as I discovered that, but, alas, moderators saw it earlier than me and deleted it. What makes You think I've been re-posting this question "every other hour"? – brilliant Apr 9 '10 at 4:22
up vote 2 down vote accepted

You don't need Wireshark for this. Firebug is perfectly capable of tearing apart requests and responses right from Firefox.

share|improve this answer
@ Ignacio Vazquez-Abrams: Hello Ignacio!!!! I tried firebug and what I got there was the same list of "input types" that You can see in my question (second vertical blue line on the left side). But, having singled them out, I still have no idea how I should include them in my request and where their correct values are. (I thought "Wireshark" would make it clear to me) Do You have any idea? – brilliant Apr 8 '10 at 23:10
Try the Net panel. – Ignacio Vazquez-Abrams Apr 8 '10 at 23:28
Is it a piece of software that I should download? Where can I get it? – brilliant Apr 8 '10 at 23:37
Yes. It's called Firebug. I already gave the link for it. – Ignacio Vazquez-Abrams Apr 8 '10 at 23:43
Ooops! I am sorry!! I didn't notice it there. :( I used "inspect" panel there. – brilliant Apr 8 '10 at 23:46

When you were asked to

simulate normal login and save the login page

it was a a request for you to login to your Yahoo account as you would do normally from a Web Browser and save the page.

As for HTTP POST/GET variables & saving them, I don't have experience but you should probably have a look at this SO answer

Seems you're the OP for the Q in SO -.-

share|improve this answer
@ Sathya: I see, Sathya, thank You for this input. – brilliant Apr 9 '10 at 3:25
Yes, Sathya, that's me there - I am doing all things possible to understand this matter. Anyway, thank You for explaining to me what that supporter meant by "simulate". As a non-English speaker, I had a hard time to catch his meaning behind that word. – brilliant Apr 9 '10 at 3:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.