Login to facebook with Indy

Question

I would like to login to my facebook account with Indy. The version is 9.00.10 and I use OpenSSL with TIDHTTP and assigned a cookie manager to it. Everything works fine (I can send a POST request a GET, etc.)

I sniffed the actual login to facebook and I have the following information:

• UserAgent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)

• There are several POST parameters:

  • lsd = I have no idea what that is.
  • email = The actual facebook username/email.
  • pass = The password (unencrypted) --> I was shocked to see in clear text.
  • default_persistent = (0 or 1) for "keep me logged in"
  • timezone = Timezone code.
  • lgnrnd = I have no idea what that is.
  • lgnjs = I have no idea what that is.
  • locale = GEOIP location (e.x. en_US)

The post is made on https://www.facebook.com/login.php?login_attempt=1. However when I try to login it returns that I have entered an incorrect eMail. I'm sure I used the right eMail and Password.

Here is my code:

procedure TForm1.Button1Click(Sender: TObject);
var
  TEST : STRING;
  lParamList: TStringList;
  i : Integer;
begin
  lParamList := TStringList.Create;
  lparamlist.Add('lsd=AVoBzJ5G');
  lparamlist.Add('email=myeMail%40mysite.com');
  lparamlist.Add('pass=mypass');
  lparamlist.Add('default_persistent=0');
  lparamlist.Add('timezone=240');
  lparamlist.Add('lgnrnd=210302_FeQV');
  lparamlist.Add('lgnjs=1367035381');
  lparamlist.Add('locale=en_US');
  IDHTTP1.Request.UserAgent := 'Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)';
  Test := IdHTTP1.Get('https://www.facebook.com'); // To get the first cookies.
  for i := 0 to IDHTTP1.CookieManager.CookieCollection.Count - 1 do begin
    ShowMessage(IDHTTP1.CookieManager.CookieCollection.Items[i].CookieText); // Show me the cookies.
  end;
  TEST := IDHTTP1.Post('https://www.facebook.com/login.php?login_attempt=1', lParamList);
  StrToFile ('text.html', test);
  ShellExecute (0, 'open', 'text.html', '', '', SW_SHOW);
end;

I used the parameters that I got from LiveHTTPHeaders. How would I successfully login to facebook with Indy?

EDIT: Tried this with XE2 and Indy 10 but I get the 'incorrect email' error:

unit Unit1;

interface

uses
  Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
  Vcl.Controls, Vcl.Forms, Vcl.Dialogs, IdCookieManager, IdIOHandler,
  IdIOHandlerSocket, IdIOHandlerStack, IdSSL, IdSSLOpenSSL, IdBaseComponent,
  IdComponent, DateUtils, ShellAPI, IdTCPConnection, IdTCPClient, IdHTTP, Vcl.StdCtrls;

type
  TForm1 = class(TForm)
    IdHTTP1: TIdHTTP;
    IdSSLIOHandlerSocketOpenSSL1: TIdSSLIOHandlerSocketOpenSSL;
    IdCookieManager1: TIdCookieManager;
    Button1: TButton;
    Memo1: TMemo;
    procedure Button1Click(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

function GetBetween (Str: String; StrStart : String; StrEnd : String) : String;
var
  iPos    : Integer;
  BackUp  : String;
begin
  result := '';
  iPos := Pos (StrStart, Str);
  if iPos <> 0 then begin
    Delete (Str, 1, iPos + Length (StrStart) - 1);
    iPos := Pos (StrEnd, Str);
    if iPos <> 0 then begin
      result := Copy(Str,1, iPos - 1);
    end;
  end;
end;

function StrToFile(szFilePath:string; dwPosition:DWORD; szInput:string):Boolean;
var
  hFile:      DWORD;
  dwSize:     DWORD;
  dwWritten:  DWORD;
begin
  Result := FALSE;
  hFile := CreateFileW(PWideChar(szFilePath), GENERIC_WRITE, 0, nil, CREATE_ALWAYS, 0, 0);
  if hFile <> INVALID_HANDLE_VALUE then
  begin
    dwSize := Length(szInput) * 2;
    if dwSize > 0 then
    begin
      SetFilePointer(hFile, dwPosition, nil, FILE_BEGIN);
      WriteFile(hFile, szInput[1], dwSize, dwWritten, nil);
      if dwWritten = dwSize then
        Result := TRUE;
    end;
    CloseHandle(hFile);
  end;
end;

procedure TForm1.Button1Click(Sender: TObject);
var
  Response      : String;
  lparamList    : TStringList;
begin
  IDHTTP1.Request.UserAgent := 'Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)';
  try
    Response := IDHTTP1.Get('https://www.facebook.com/');
  except

  end;
  lParamList := TStringList.Create;
  lParamList.Add('lsd='+GetBetween (Response, 'name="lsd" value="', '"'));
  lParamList.Add('[email protected]');
  lParamList.Add('pass=myPassword');
  lParamList.Add('default_persistent'+GetBetween (Response, 'name="default_persistent" value="', '"'));
  lParamList.Add('timezone=240');
  lParamList.Add('lgnrnd='+GetBetween (Response, 'name="lgnrnd" value="', '"'));
  lParamList.Add('lgnjs='+inttostr(DateTimeToUnix(Now)));
  lParamList.Add('locale=en_US');
  IDHTTP1.Request.Referer := 'https://www.facebook.com/';
  try
    Response := IDHTTP1.Post('https://www.facebook.com/login.php?login_attempt=1', lparamList);
  except

  end;
  StrToFile ('test.html', 0, Response);
  ShellExecute (0, 'open', 'test.html', '', '', SW_SHOW);
end;

end.

Answer 1

If the hoForceEncodeParams flag is enabled in the TIdHTTP.HTTPOptions property (which it is by default), then you need to fill the posted TStringList with un-encoded values. TIdHTTP.Post() will then encode the values for you when transmitting them.

Assuming the hoForceEncodeParams flag is enabled, lparamlist.Add('email=myeMail%40mysite.com'); would be transmitted as email=myeMail%2540mysite.com because the % character gets encoded as %25. Facebook would decode that as email=myeMail%40mysite.com and reject it as an invalid email.

You can either:

1. disable the hoForceEncodeParams flag so the TStringList values get transmitted as-is. You would then be responsible for encoding them manually.

2. leave the hoForceEncodeParams flag enabled and change lparamlist.Add('email=myeMail%40mysite.com'); to lparamlist.Add('[email protected]'); instead. TIdHTTP.Post() in Indy 9 will then transmit it as [email protected] because Indy 9 does not encode the @ character. That may or may not work, depending on how lenient Facebook is.

If you upgrade to Indy 10, TIdHTTP.Post() will encode the @ character as %40 as expected when the hoForceEncodeParams flag is enabled.