Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been trying to find a python code that would log in to my mail box on from "Google App Engine". I was given this code:

import urllib, urllib2, cookielib

url = ""
form_data = {'login' : 'my-login-here', 'passwd' : 'my-password-here'}

jar = cookielib.CookieJar()
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(jar))
form_data = urllib.urlencode(form_data)
# data returned from this pages contains redirection
resp =, form_data)
# yahoo redirects to, so lets go there instead
resp ='')

The author of this script looked into HTML script of yahoo log-in form and came up with this script.

That log-in form contains two fields, one for users' Yahoo! ID and another one is for users' password.

However, when I tried this code out (substituting mu real Yahoo login for 'my-login-here' and my real password for 'my-password-here'), it just return the log-in form back to me, which means that something didn't work right.

Another supporter suggested that I should send an MD5 hash of my password, rather than a plain password.

He also noted that in that log-in form there are a lot other hidden fields besides login and password fields (he called them "CSRF protections") that I would also have to deal with:

<input type="hidden" name=".tries" value="1"> 
<input type="hidden" name=".src" value="ym"> 
<input type="hidden" name=".md5" value=""> 
<input type="hidden" name=".hash" value=""> 
<input type="hidden" name=".js" value=""> 
<input type="hidden" name=".last" value=""> 
<input type="hidden" name="promo" value=""> 
<input type="hidden" name=".intl" value="us"> 
<input type="hidden" name=".bypass" value=""> 
<input type="hidden" name=".partner" value=""> 
<input type="hidden" name=".u" value="bd5tdpd5rf2pg"> 
<input type="hidden" name=".v" value="0"> 
<input type="hidden" name=".challenge" value="5qUiIPGVFzRZ2BHhvtdGXoehfiOj"> 
<input type="hidden" name=".yplus" value=""> 
<input type="hidden" name=".emailCode" value=""> 
<input type="hidden" name="pkg" value=""> 
<input type="hidden" name="stepid" value=""> 
<input type="hidden" name=".ev" value=""> 
<input type="hidden" name="hasMsgr" value="0"> 
<input type="hidden" name=".chkP" value="Y"> 
<input type="hidden" name=".done" value=""> 

He said that I should do the following:

  1. Simulate normal login and save login page that I get;
  2. Save POST&GET headers with "Wireshark";
  3. Compare login page with those headers and see what fields I need to include with my request;

I really don't know how to carry out the first two of these three steps. I have just downloaded "Wireshark" and have tried capturing some packets there. However, I don't know how to "simulate normal login and save the login page". Also, I don't how to save POST$GET headers with "Wireshark". Can anyone, please, guide me through these two steps in "Wireshark"? Or at least tell me what I should start with. Thank You.

share|improve this question
Stop reposting this question every other hour. – random Apr 9 '10 at 4:02
random, please take note that all the questions that I have posted so far are different. For example, on SO I asked a question about what a header is, and this present question is about how to use "Wireshark" to get POST&GET headers. This one I have accidentally re-posted only once and wanted to delete the twin as soon as I discovered that, but, alas, moderators saw it earlier than me and deleted it. What makes You think I've been re-posting this question "every other hour"? – brilliant Apr 9 '10 at 4:22
up vote 2 down vote accepted

You don't need Wireshark for this. Firebug is perfectly capable of tearing apart requests and responses right from Firefox.

share|improve this answer
@ Ignacio Vazquez-Abrams: Hello Ignacio!!!! I tried firebug and what I got there was the same list of "input types" that You can see in my question (second vertical blue line on the left side). But, having singled them out, I still have no idea how I should include them in my request and where their correct values are. (I thought "Wireshark" would make it clear to me) Do You have any idea? – brilliant Apr 8 '10 at 23:10
Try the Net panel. – Ignacio Vazquez-Abrams Apr 8 '10 at 23:28
Is it a piece of software that I should download? Where can I get it? – brilliant Apr 8 '10 at 23:37
Yes. It's called Firebug. I already gave the link for it. – Ignacio Vazquez-Abrams Apr 8 '10 at 23:43
Ooops! I am sorry!! I didn't notice it there. :( I used "inspect" panel there. – brilliant Apr 8 '10 at 23:46

When you were asked to

simulate normal login and save the login page

it was a a request for you to login to your Yahoo account as you would do normally from a Web Browser and save the page.

As for HTTP POST/GET variables & saving them, I don't have experience but you should probably have a look at this SO answer

Seems you're the OP for the Q in SO -.-

share|improve this answer
@ Sathya: I see, Sathya, thank You for this input. – brilliant Apr 9 '10 at 3:25
Yes, Sathya, that's me there - I am doing all things possible to understand this matter. Anyway, thank You for explaining to me what that supporter meant by "simulate". As a non-English speaker, I had a hard time to catch his meaning behind that word. – brilliant Apr 9 '10 at 3:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .