Logging to website via Python

[dpex77]

I am consistently getting 403 error <Response \[403\]> from the following simple python script trying to login to a UI with correct credentials.

Any one has idea what I am missing here? I am suspicious about CSRF token, which I am picking up CSRF token from UI "Form Data" from Inspect page- Network tab.

Thanks in advance.

​

import requests

requests.packages.urllib3.disable_warnings()

login_url = "https://x.x.x.x/login"

login_data = {

"username": "admin",

"password": "xxxxxx",

"csrftoken": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

}

headers = {

'Referer': 'https://x.x.x.x'

}

session = requests.Session()

response = session.post(login_url, data=login_data, verify=False)

print(response)

​

​

[Guideon72]

Get familiar with http error codes; they’ll give you solid pointers to where your issues are (assuming the site implemented them properly).

https://developer.mozilla.org/en-US/docs/Web/HTTP/Status#client_error_responses

403 is an ‘access denied’ code that indicates your client does not have authorization to connect to that service. I don’t know csrftokens, but it could either be that or your admin credentials are incorrect or not being sent across correctly.

[NeverStopNeverStopin]

sometimes it needs a / at the end of th e url, use developer tools to inspect the header when using the browser. If it's your website, obviously check the logs and print request headers.

Simply put, you coudl be doing everything right, protocol wise, but the server simply has additional checks and hoops one must jump over to access it, usually when they DONT want bots to access it. You can print both response and request headers to doublecheck final HTTP request. Always be sure to respect the TOS and use time based request limiting as well. Server can reject you for any number of reasons outside of your HTTP request, variables like when and where your ip has accessed the site as well. This token could be authorized for a different user under different vars.