Posting a VBulletin thread

[Fraysa]

I wasn't sure where to post it, so I thought this would be a good place. I opened a new thread and looked at the POST request so I can recreate it with .NET.

Is anyone familiar with these values? Like, what's 'posthash', 'securitytoken' (I assume it's the token for logged-in users), and how would I get them through my code?

Thanks.

 

[AngraMainyu]

Writing a Shitzone bot, Fraysa?

Some of these things are generated internally by VBulletin (and then injected into the javascript response, which then injects them into forms, and lots of other crazy stuff.) Security token should be empty in most fields until submit time but the regex for it is

var SECURITYTOKEN = "(.+)";

. That should be all you need to get requests working, as well as a valid, fake useragent preserved across requests. Post hash should be an MD5 of your post, I think. Not sure if it's required.

Anyway, security tokens don't refresh for a while and can be used for different actions than they were generated for (i.e. if you get a security token from a thread, you can use it in any form around the site until it expires.) They're tokens sure, and that's obnoxious to handle in code, but they're the most hilariously insecure technique anyone could possibly use. Make one GET request for information like userid, securitytoken, etc and then send a POST with the data you got and it's problem solved.

 

[Fraysa]

Writing a Shitzone bot, Fraysa?

Some of these things are generated internally by VBulletin (and then injected into the javascript response, which then injects them into forms, and lots of other crazy stuff.) Security token should be empty in most fields until submit time but the regex for it is

var SECURITYTOKEN = "(.+)";

. That should be all you need to get requests working, as well as a valid, fake useragent preserved across requests. Post hash should be an MD5 of your post, I think. Not sure if it's required.

Anyway, security tokens don't refresh for a while and can be used for different actions than they were generated for (i.e. if you get a security token from a thread, you can use it in any form around the site until it expires.) They're tokens sure, and that's obnoxious to handle in code, but they're the most hilariously insecure technique anyone could possibly use. Make one GET request for information like userid, securitytoken, etc and then send a POST with the data you got and it's problem solved.

Thank you very much, I will give that a try!

.. And to your question, it's... sort of a bot, but for good purpose. It's just a notifier. It won't spam threads, so no worries.