Login to facebook with Indy - facebook

Question

I would like to login to my facebook account with Indy. The version is 9.00.10 and I use OpenSSL with TIDHTTP and assigned a cookie manager to it. Everything works fine (I can send a POST request a GET, etc.)
I sniffed the actual login to facebook and I have the following information:
UserAgent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)
There are several POST parameters:
lsd = I have no idea what that is.
email = The actual facebook username/email.
pass = The password (unencrypted) --> I was shocked to see in clear text.
default_persistent = (0 or 1) for "keep me logged in"
timezone = Timezone code.
lgnrnd = I have no idea what that is.
lgnjs = I have no idea what that is.
locale = GEOIP location (e.x. en_US)
The post is made on https://www.facebook.com/login.php?login_attempt=1. However when I try to login it returns that I have entered an incorrect eMail. I'm sure I used the right eMail and Password.
Here is my code:
procedure TForm1.Button1Click(Sender: TObject);
var
TEST : STRING;
lParamList: TStringList;
i : Integer;
begin
lParamList := TStringList.Create;
lparamlist.Add('lsd=AVoBzJ5G');
lparamlist.Add('email=myeMail%40mysite.com');
lparamlist.Add('pass=mypass');
lparamlist.Add('default_persistent=0');
lparamlist.Add('timezone=240');
lparamlist.Add('lgnrnd=210302_FeQV');
lparamlist.Add('lgnjs=1367035381');
lparamlist.Add('locale=en_US');
IDHTTP1.Request.UserAgent := 'Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)';
Test := IdHTTP1.Get('https://www.facebook.com'); // To get the first cookies.
for i := 0 to IDHTTP1.CookieManager.CookieCollection.Count - 1 do begin
ShowMessage(IDHTTP1.CookieManager.CookieCollection.Items[i].CookieText); // Show me the cookies.
end;
TEST := IDHTTP1.Post('https://www.facebook.com/login.php?login_attempt=1', lParamList);
StrToFile ('text.html', test);
ShellExecute (0, 'open', 'text.html', '', '', SW_SHOW);
end;
I used the parameters that I got from LiveHTTPHeaders.
How would I successfully login to facebook with Indy?
EDIT: Tried this with XE2 and Indy 10 but I get the 'incorrect email' error:
unit Unit1;
interface
uses
Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
Vcl.Controls, Vcl.Forms, Vcl.Dialogs, IdCookieManager, IdIOHandler,
IdIOHandlerSocket, IdIOHandlerStack, IdSSL, IdSSLOpenSSL, IdBaseComponent,
IdComponent, DateUtils, ShellAPI, IdTCPConnection, IdTCPClient, IdHTTP, Vcl.StdCtrls;
type
TForm1 = class(TForm)
IdHTTP1: TIdHTTP;
IdSSLIOHandlerSocketOpenSSL1: TIdSSLIOHandlerSocketOpenSSL;
IdCookieManager1: TIdCookieManager;
Button1: TButton;
Memo1: TMemo;
procedure Button1Click(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;
var
Form1: TForm1;
implementation
{$R *.dfm}
function GetBetween (Str: String; StrStart : String; StrEnd : String) : String;
var
iPos : Integer;
BackUp : String;
begin
result := '';
iPos := Pos (StrStart, Str);
if iPos <> 0 then begin
Delete (Str, 1, iPos + Length (StrStart) - 1);
iPos := Pos (StrEnd, Str);
if iPos <> 0 then begin
result := Copy(Str,1, iPos - 1);
end;
end;
end;
function StrToFile(szFilePath:string; dwPosition:DWORD; szInput:string):Boolean;
var
hFile: DWORD;
dwSize: DWORD;
dwWritten: DWORD;
begin
Result := FALSE;
hFile := CreateFileW(PWideChar(szFilePath), GENERIC_WRITE, 0, nil, CREATE_ALWAYS, 0, 0);
if hFile <> INVALID_HANDLE_VALUE then
begin
dwSize := Length(szInput) * 2;
if dwSize > 0 then
begin
SetFilePointer(hFile, dwPosition, nil, FILE_BEGIN);
WriteFile(hFile, szInput[1], dwSize, dwWritten, nil);
if dwWritten = dwSize then
Result := TRUE;
end;
CloseHandle(hFile);
end;
end;
procedure TForm1.Button1Click(Sender: TObject);
var
Response : String;
lparamList : TStringList;
begin
IDHTTP1.Request.UserAgent := 'Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)';
try
Response := IDHTTP1.Get('https://www.facebook.com/');
except
end;
lParamList := TStringList.Create;
lParamList.Add('lsd='+GetBetween (Response, 'name="lsd" value="', '"'));
lParamList.Add('eMail=myEmail#mySite.com');
lParamList.Add('pass=myPassword');
lParamList.Add('default_persistent'+GetBetween (Response, 'name="default_persistent" value="', '"'));
lParamList.Add('timezone=240');
lParamList.Add('lgnrnd='+GetBetween (Response, 'name="lgnrnd" value="', '"'));
lParamList.Add('lgnjs='+inttostr(DateTimeToUnix(Now)));
lParamList.Add('locale=en_US');
IDHTTP1.Request.Referer := 'https://www.facebook.com/';
try
Response := IDHTTP1.Post('https://www.facebook.com/login.php?login_attempt=1', lparamList);
except
end;
StrToFile ('test.html', 0, Response);
ShellExecute (0, 'open', 'test.html', '', '', SW_SHOW);
end;
end.

Answer 1

If the hoForceEncodeParams flag is enabled in the TIdHTTP.HTTPOptions property (which it is by default), then you need to fill the posted TStringList with un-encoded values. TIdHTTP.Post() will then encode the values for you when transmitting them.
Assuming the hoForceEncodeParams flag is enabled, lparamlist.Add('email=myeMail%40mysite.com'); would be transmitted as email=myeMail%2540mysite.com because the % character gets encoded as %25. Facebook would decode that as email=myeMail%40mysite.com and reject it as an invalid email.
You can either:
disable the hoForceEncodeParams flag so the TStringList values get transmitted as-is. You would then be responsible for encoding them manually.
leave the hoForceEncodeParams flag enabled and change lparamlist.Add('email=myeMail%40mysite.com'); to lparamlist.Add('email=myeMail#mysite.com'); instead. TIdHTTP.Post() in Indy 9 will then transmit it as email=myeMail#mysite.com because Indy 9 does not encode the # character. That may or may not work, depending on how lenient Facebook is.
If you upgrade to Indy 10, TIdHTTP.Post() will encode the # character as %40 as expected when the hoForceEncodeParams flag is enabled.

Answer 2

For anyone interested, the OP's code works just fine with the mobile versions of Facebook, so just replace www.facebook.com with touch/m.facebook.com.
Now if the OP would also be kind enough to share how he got the full version to work (at least the Cookies not enabled part), I'm sure we'll all be grateful.