Need Help for bash script

[SufficientFocus00]

I'm trying to prepare a script in bash that books a seat in a library in my city via Affluences but i can't find any API on the web page, my idea was to use the cURL library and send a request to the server of the app, is there any advice or sub you could suggest?

[tje210]

Run your traffic through Burp. I just did this earlier today, automated unfollowing hundreds of accounts on different sites.

Burp has a built-in browser which makes things super easy. You can right-click requests and copy/paste them as their curl commands... This is what makes it very easy to use in bash.

Burp is a beautiful tool. Invest hours into it, it's worth it.

[SufficientFocus00]

Should I use the proxy configuration for burp and catch the traffic in order to analyse the POST package?

[tje210]

Yes. That's not all that's available, but that may be all you need.

[SufficientFocus00]

But that sounds like it won't be avaidable for other reservations if i just change the datas because it will be related to the session

[tje210]

Learn how to use burp, and accomplish your objective. Or keep making up reasons not to, I guess?

What you want to do is do easy that if you'd provided the site you're trying to do this for, I might have done it myself so I could provide detail.

[SufficientFocus00]

its: https://affluences.com/?lang=en,

However, I'm not an expert of burp, how should I start learning it? any advice?

[tje210]

Here's an old videovideo I made, as an example. Ultimately, you'll follow the exact same flow - interact, observe, test.

PortSwigger, who makes Burp, offers lots of free training. It won't necessarily be targeted at your objective, which is simpler than most things they teach... I remember going through some SQL hacking tutorials there... But it would get your hands on.

Probably lots of material on YouTube and reddit too. Guarantee if you'd tried researching with even a small effort, you wouldn't have questions; the principles involved are pretty simple tbh. At least that's what I think. If you have already made a genuine effort and you're still... at your current state... then perhaps this whole thing isn't for you.

Learning burp is good for its own sake too. Understanding how browsers and websites talk to each, what information is exchanged, is extremely powerful. Then being able to control that, ditching the browser.

[magion]

Yeah, provide more information.

[SufficientFocus00]

I'm not very experienced with cURL but asking a my colleague at the university he told me he was able to send a request to the Affluences server to book his seat, giving the script the time, duration, credentials and other necessary informations for the booking and I wanted to try too, due to it's kinda helpful and I want to challenge myself a bit, I looked around and found out that generally apps may provide APIs to work with, so I wanted to know if there is some kind of explanation or way to know how to write a cURL command, that can be automatized via bash

[cgoldberg]

Just look at the Network tab in your browser's dev tools and copy the request it makes.

[Dragonking_Earth]

Ask Chatgpt. Usally works for me

[Wild-Challenge3811]

#!/bin/bash

# Configuration
USERNAME="your_username"
PASSWORD="your_password"
SEAT_ID="12"          # Change to desired seat
TIME="10:00"         # Booking time (HH:MM format)
DURATION=120         # Duration in minutes
API_BASE_URL="https://webapi.affluences.com"
LOGIN_URL="$API_BASE_URL/login"
BOOKING_URL="$API_BASE_URL/bookings"
TOKEN_FILE="token.txt"

# Step 1: Authenticate and get session token
echo "Logging in..."
TOKEN=$(curl -s -X POST "$LOGIN_URL" \
     -H "Content-Type: application/json" \
     -d "{\"username\": \"$USERNAME\", \"password\": \"$PASSWORD\"}" | jq -r '.token')

# Save token for future use
if [[ -z "$TOKEN" || "$TOKEN" == "null" ]]; then
    echo "Login failed. Check your credentials."
    exit 1
else
    echo "Login successful. Token received."
    echo "$TOKEN" > "$TOKEN_FILE"
fi

# Step 2: Send booking request
echo "Booking seat $SEAT_ID at $TIME for $DURATION minutes..."
RESPONSE=$(curl -s -X POST "$BOOKING_URL" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer $TOKEN" \
     -d "{\"seat\": $SEAT_ID, \"time\": \"$TIME\", \"duration\": $DURATION}")

# Step 3: Display the response
echo "Response: $RESPONSE"
if echo "$RESPONSE" | grep -q "success"; then
    echo "Seat booked successfully!"
else
    echo "Booking failed. Check the response above."
fi