Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have exported a pair of cookies from Firefox that are valid for the URL in question and tried accessing/downloading the protected content off that address, but the end result is a return to the login page. I have tried doing the same thing for 3 other websites with similar outcome. Any clues as to what I might be doing wrong?

The syntax I'm using: wget --load--cookies=FILE URL

-----------------------------------------------
DEBUG output created by Wget 1.12 on linux-gnu.


Stored cookie www.x.org -1 (ANY) / <permanent> <insecure> [expiry 1901-12-13 22:25:44] c_secure_login lz8xZQ%3D%3D

Stored cookie www.x.org -1 (ANY) / <permanent> <insecure> [expiry 1901-12-13 22:25:44] c_secure_pass 
2fd4e1c67a2d28fced849ee1bb76e74a

Stored cookie www.x.org -1 (ANY) / <permanent> <insecure> [expiry 1901-12-13 22:25:44] c_secure_uid GZX4TDA%3D
--2011-01-14 13:57:02--  www.x.org/download.php?id=397003
Resolving www.x.org... 1.1.1.1
Caching www.x.org => 1.1.1.1
Connecting to www.x.org|1.1.1.1|:80... connected.
Created socket 5.
Releasing 0x0943ef20 (new refcount 1).

---request begin---
GET /download.php?id=397003 HTTP/1.0
User-Agent: Wget/1.12 (linux-gnu)
Accept: */*
Host: www.x.org
Connection: Keep-Alive

---request end---
HTTP request sent, awaiting response...
---response begin---
HTTP/1.1 302 Found
Date: Fri, 14 Jan 2011 11:26:19 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny8
Set-Cookie: PHPSESSID=5f2fd97103f8988554394f23c5897765; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: www.x.org/login.php?returnto=download.php%3Fid%3D397003
Vary: Accept-Encoding
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html

---response end---
302 Found

Stored cookie www.x.org -1 (ANY) / <session> <insecure> [expiry none] PHPSESSID 5f2fd97103f8988554394f23c5897765
Registered socket 5 for persistent reuse.
Location: www.x.org/login.php?returnto=download.php%3Fid%3D397003 [following]
Skipping 0 bytes of body: [] done.
--2011-01-14 13:57:02--  www.x.org/login.php?returnto=download.php%3Fid%3D397003
Reusing existing connection to www.x.org:80.
Reusing fd 5.

---request begin---
GET /login.php?returnto=download.php%3Fid%3D397003 HTTP/1.0
User-Agent: Wget/1.12 (linux-gnu)
Accept: */*
Host: www.x.org
Connection: Keep-Alive
Cookie: PHPSESSID=5f2fd97103f8988554394f23c5897765

---request end---
HTTP request sent, awaiting response...
---response begin---
HTTP/1.1 200 OK
Date: Fri, 14 Jan 2011 11:26:20 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 2171
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html

---response end---
200 OK
Length: 2171 (2.1K) [text/html]
Saving to: `x.out'

     0K ..                                                    100% 18.7M=0s

2011-01-14 13:57:02 (18.7 MB/s) - `x.out' saved [2171/2171]
share|improve this question
    
Keep in mind that wget is not the silver bullet for site scrapping anymore. It can't handle JavaScript. – AnonymousLurker Oct 8 '12 at 7:23

well, i have figured it out, finally :)

as it seems - the 'pass' cookie was generated with the salt of the IP address: initially, i have exported the cookies from a Windows OS and was wget-ing already from a different IP.

in the end, after heaps of trial and error, i have lynx-ed my way through to the website in question and took a look at the cookies after a succesful login - the 'pass' cookie was indeed different!

share|improve this answer
    
a small note (that wasn't obvious to me before, but was suggested by another person): the IP isn't kept on-site in the db to match against (as i thought), apparently the following is hashed - uid + stored passwd hash + ip salt and made into 1 'pass' field cookie – XXL Jan 15 '11 at 21:42

Have you tried viewing the cookie in your browser's "cookie manager?"

Try copying the cookie and using: wget --no-cookies --header "Cookie: name=value"

share|improve this answer
    
yes, i have tried doing that - sadly, with the same outcome. – XXL Jan 14 '11 at 15:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .