Impersonate Login Page

[Guest]

My company has a third party purchased website that we use to allow clients
to log in and view/modify orders in our system.

It has its own login page, but I would like to add a form to my companies
own website to post the login directly (for client conveniance reasons).

Below is the code that I'm attempting to use, the post seems to be working
fine, but I'm getting an error back that "WebTrac Pro is not available at
this time, Please contact your administrator or check the log for details"
(the log is empty).

I'm wondering if maybe they are explicitly checking "where" the login
attempt is coming from and blocking it if it isn't what they expect? Is this
a common practice?

Here is the code:



-----------
Dim stringPost = Request.Form.ToString

Dim httpWebRequest As System.Net.HttpWebRequest =
System.Net.HttpWebRequest.Create("https://web.hmic.com/webtracpro/ModelDriver.aspx")

httpWebRequest.Method = "POST"

httpWebRequest.ContentLength = stringPost.Length

httpWebRequest.ContentType = "application/x-www-form-urlencoded"

Dim streamWriter = New
System.IO.StreamWriter(httpWebRequest.GetRequestStream())

streamWriter.Write(stringPost)

streamWriter.Close()

Dim httpWebResponse As System.Net.HttpWebResponse =
httpWebRequest.GetResponse()

Dim streamReader = New
System.IO.StreamReader(httpWebResponse.GetResponseStream())

Dim stringResult = streamReader.ReadToEnd()

streamReader.Close()

Response.Write(stringResult)
---------

 

[Scott Allen]

I'm wondering if maybe they are explicitly checking "where" the login
attempt is coming from and blocking it if it isn't what they expect? Is this
a common practice?

I'd suggest using Fiddler [1] to compare what your code sends to the
web site with what a web browser sends. Sometimes it's the littlest
things that make the difference, for instance, I've come across more
than one site that checks the user agent string. If the sites didn't
recognize the user agent they'd simply return a 404 or a 500 code. You
can set your own user agent string to make your request look like an
IE request with the UserAgent property on HttpWebRequest.

[1] http://www.fiddlertool.com/fiddler/

HTH,