Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Unable to login - Codeforces javascript redirect issue #143

Closed
shank03 opened this issue Oct 18, 2021 · 14 comments
Closed

Unable to login - Codeforces javascript redirect issue #143

shank03 opened this issue Oct 18, 2021 · 14 comments

Comments

@shank03
Copy link

shank03 commented Oct 18, 2021 •
edited

Recently codeforces updated there web service to redirect through javascript to destination page. Because of this, the GET returns the page that redirects (not the final landing page) hence, the command line prompts Unable to find csrf.

This is what it returns:

<html>
 <head></head>
 <body>
  Redirecting... Please, wait.
  <script type="text/javascript" src="/aes.min.js"></script>
  <script>function toNumbers(d){var e=[];d.replace(/(..)/g,function(d){e.push(parseInt(d,16))});return e}function toHex(){for(var d=[],d=1==arguments.length&&arguments[0].constructor==Array?arguments[0]:arguments,e="",f=0;f<d.length;f++)e+=(16>d[f]?"0":"")+d[f].toString(16);return e.toLowerCase()}var a=toNumbers("e9ee4b03c1d0822987185d27bca23378"),b=toNumbers("188fafdbe0f87ef0fc2810d5b3e34705"),c=toNumbers("ff42be26c8159cd50f366324c648d42c");document.cookie="RCPC="+toHex(slowAES.decrypt(c,2,a,b))+"; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/";document.location.href="https://codeforces.com/enter?f0a28=1";</script>
 </body>
</html>

Can you please update the tool to handle this ?
Thanks
@tiger2005
Copy link

I thought that it requires cookie to verify identity. I tested serveral ways to send with cookie by Javascript but failed.
If someone can fix this, here is the cookie:
"RCPC=b55e2327c11ddadd0613edfb307a981d; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/"

@DonHalkon
Copy link

I thought that it requires cookie to verify identity. I tested serveral ways to send with cookie by Javascript but failed.
If someone can fix this, here is the cookie:
"RCPC=b55e2327c11ddadd0613edfb307a981d; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/"

I am not sure that hardcoded cookie usage is a good idea. Codeforces can revoke it or change the algorithm at any moment.

@tiger2005
Copy link

I thought that it requires cookie to verify identity. I tested serveral ways to send with cookie by Javascript but failed.
If someone can fix this, here is the cookie:
"RCPC=b55e2327c11ddadd0613edfb307a981d; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/"

I am not sure that hardcoded cookie usage is a good idea. Codeforces can revoke it or change the algorithm at any moment.

I also doubted about it. If Codeforces changes the seed rapidly or randomly, the problem may be super difficult. But, at lease previous 2 days, the seed weren't changes.

@shank03
Copy link
Author

shank03 commented Oct 19, 2021

I managed somehow to overcome the redirect issue, but then, https://github.com/xalanq/cf-tool/blob/master/client/login.go#L78-L87 this block of params isn't accepted anymore. It throws 403 error (i.e. Request recognized but not authorized).

Looks like someone will have re-research (if that's a term) the whole login process again

@tiger2005
Copy link

I managed somehow to overcome the redirect issue, but then, https://github.com/xalanq/cf-tool/blob/master/client/login.go#L78-L87 this block of params isn't accepted anymore. It throws 403 error (i.e. Request recognized but not authorized).

Looks like someone will have re-research (if that's a term) the whole login process again

Please tell me how you solved the redirect problem. I developed this kind of software, too. I can use this method to pass the verification and try to figure out the apis of 'login'.

@shank03
Copy link
Author

shank03 commented Oct 19, 2021

I managed somehow to overcome the redirect issue, but then, https://github.com/xalanq/cf-tool/blob/master/client/login.go#L78-L87 this block of params isn't accepted anymore. It throws 403 error (i.e. Request recognized but not authorized).
Looks like someone will have re-research (if that's a term) the whole login process again

Please tell me how you solved the redirect problem. I developed this kind of software, too. I can use this method to pass the verification and try to figure out the apis of 'login'.

I used selenium web driver with headless argument (which opens browser in background) and then tried to login using those params.

@tiger2005
Copy link

I managed somehow to overcome the redirect issue, but then, https://github.com/xalanq/cf-tool/blob/master/client/login.go#L78-L87 this block of params isn't accepted anymore. It throws 403 error (i.e. Request recognized but not authorized).
Looks like someone will have re-research (if that's a term) the whole login process again

Please tell me how you solved the redirect problem. I developed this kind of software, too. I can use this method to pass the verification and try to figure out the apis of 'login'.

I used selenium web driver with headless argument (which opens browser in background) and then tried to login using those params.

I use external window and finally solved the problem. https://github.com/CodeforcesContestHelper/CCHv2/blob/dev/js/authorize.js#L82:L91 Here are the data I used to enter, quite similar with how login.go does, and I can login after the verification.
Sorry that I can't help (I'm a Go noob), but I have some ideas. Does the program clean the cookie after the verification?

@DonHalkon
Copy link

Codeforces disabled redirect

@shank03
Copy link
Author

shank03 commented Oct 19, 2021

Oh damn

@tiger2005
Copy link

Oh damn

Useless work :( But at lease we found a way to avoid redirection!

@shank03
Copy link
Author

shank03 commented Oct 19, 2021

Oh damn

Useless work :( But at lease we found a way to avoid redirection!

Yup.. learning everyday.

So I'll close this then :)

@shank03 shank03 closed this as completed Oct 19, 2021
@rishakil
Copy link

I am facing the same issue. Did anyone resolve this? Can you please tell me what to do?

@tiger2005
Copy link

tiger2005 commented Nov 20, 2022 •
edited

I am facing the same issue. Did anyone resolve this? Can you please tell me what to do?

The solution is to decrypt the codes in the redirect page and get the right key. You can search for the algorithm in some forks of this project.

@rishakil
Copy link

I am facing the same issue. Did anyone resolve this? Can you please tell me what to do?

The solution is to decrypt the codes in the redirect page and get the right key. You can search for the algorithm in some forks of this project.

Can you help me by providing the procedure to decrypt and fix it? Sorry if this sounds novice.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@DonHalkon @shank03 @tiger2005 @rishakil