Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have exported a pair of cookies from Firefox that are valid for the URL in question and tried accessing/downloading the protected content off that address, but the end result is a return to the login page. I have tried doing the same thing for 3 other websites with similar outcome. Any clues as to what I might be doing wrong?

The syntax I'm using: wget --load--cookies=FILE URL

-----------------------------------------------
DEBUG output created by Wget 1.12 on linux-gnu.


Stored cookie www.x.org -1 (ANY) / <permanent> <insecure> [expiry 1901-12-13 22:25:44] c_secure_login lz8xZQ%3D%3D

Stored cookie www.x.org -1 (ANY) / <permanent> <insecure> [expiry 1901-12-13 22:25:44] c_secure_pass 
2fd4e1c67a2d28fced849ee1bb76e74a

Stored cookie www.x.org -1 (ANY) / <permanent> <insecure> [expiry 1901-12-13 22:25:44] c_secure_uid GZX4TDA%3D
--2011-01-14 13:57:02--  www.x.org/download.php?id=397003
Resolving www.x.org... 1.1.1.1
Caching www.x.org => 1.1.1.1
Connecting to www.x.org|1.1.1.1|:80... connected.
Created socket 5.
Releasing 0x0943ef20 (new refcount 1).

---request begin---
GET /download.php?id=397003 HTTP/1.0
User-Agent: Wget/1.12 (linux-gnu)
Accept: */*
Host: www.x.org
Connection: Keep-Alive

---request end---
HTTP request sent, awaiting response...
---response begin---
HTTP/1.1 302 Found
Date: Fri, 14 Jan 2011 11:26:19 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny8
Set-Cookie: PHPSESSID=5f2fd97103f8988554394f23c5897765; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: www.x.org/login.php?returnto=download.php%3Fid%3D397003
Vary: Accept-Encoding
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html

---response end---
302 Found

Stored cookie www.x.org -1 (ANY) / <session> <insecure> [expiry none] PHPSESSID 5f2fd97103f8988554394f23c5897765
Registered socket 5 for persistent reuse.
Location: www.x.org/login.php?returnto=download.php%3Fid%3D397003 [following]
Skipping 0 bytes of body: [] done.
--2011-01-14 13:57:02--  www.x.org/login.php?returnto=download.php%3Fid%3D397003
Reusing existing connection to www.x.org:80.
Reusing fd 5.

---request begin---
GET /login.php?returnto=download.php%3Fid%3D397003 HTTP/1.0
User-Agent: Wget/1.12 (linux-gnu)
Accept: */*
Host: www.x.org
Connection: Keep-Alive
Cookie: PHPSESSID=5f2fd97103f8988554394f23c5897765

---request end---
HTTP request sent, awaiting response...
---response begin---
HTTP/1.1 200 OK
Date: Fri, 14 Jan 2011 11:26:20 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 2171
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html

---response end---
200 OK
Length: 2171 (2.1K) [text/html]
Saving to: `x.out'

     0K ..                                                    100% 18.7M=0s

2011-01-14 13:57:02 (18.7 MB/s) - `x.out' saved [2171/2171]
share|improve this question
    
Keep in mind that wget is not the silver bullet for site scrapping anymore. It can't handle JavaScript. –  AnonymousLurker Oct 8 '12 at 7:23

2 Answers 2

Have you tried viewing the cookie in your browser's "cookie manager?"

Try copying the cookie and using: wget --no-cookies --header "Cookie: name=value"

share|improve this answer
    
yes, i have tried doing that - sadly, with the same outcome. –  XXL Jan 14 '11 at 15:29

well, i have figured it out, finally :)

as it seems - the 'pass' cookie was generated with the salt of the IP address: initially, i have exported the cookies from a Windows OS and was wget-ing already from a different IP.

in the end, after heaps of trial and error, i have lynx-ed my way through to the website in question and took a look at the cookies after a succesful login - the 'pass' cookie was indeed different!

share|improve this answer
    
a small note (that wasn't obvious to me before, but was suggested by another person): the IP isn't kept on-site in the db to match against (as i thought), apparently the following is hashed - uid + stored passwd hash + ip salt and made into 1 'pass' field cookie –  XXL Jan 15 '11 at 21:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.