I am building a script to automate some tasks in a classifieds site I use frequently. I have successfully scripted everything except for 1 piece. I have examined the HTTP posts during login, and there are 2 form values that are being dynamically added to the DOM just before form submission: "x" and "y". I know this because x and y appear in my form post inspector, but these do NOT appear in the page source anywhere. These get set to different integers each time, and I believe they're being used to defeat scripted logins. I believe the server-side code is checking for a match on those 2 vars. The funny thing is the system allows me to login via script (no errors or warnings - I am just not submitting x and y), but when I get down to submitting a classified item, it is not successful. I know I am successfully submitting all form vars on all pages EXCEPT for this x/y stuff on the login page, because all the rest are static.

I have tried in vain to figure out which values x and y should be, and I know they have to be embedded in the javascript someplace, since it's a client-side DOM update occurring. There is a lot of javascript going on, several js include files, including jQuery, and lots of custom js.

  • Firebug acts like there is no javascript, which I can't understand.

  • The firefox plugin "Javascript Deobfuscator" is very interesting and is showing me all the js that actually executes, but it's a voluminous amount and I don't even know where to start looking.


If I could figure out how to use firebug to attach to the form submit (login) button somehow, and debug through that, I'm sure I could find the mystery code adding the 2 form elements. Or maybe there's a more straightforward way to discover this.

The login page is here: www.ksl.com/public/member/signin

Any help with this would be greatly appreciated.