1

I use Lynx web browser from remote SSH (so I have no GUI) to enter into the web interface of some router and access points.

It works fine with some Ovislink and Buffalo models I have tested, but it shows no info on screen when trying to navigate to two D-Link models. Authentication should be the first step on both devices, but Lynx does not ask me for it. The OvisLink model does not ask for password, but the Buffalo does, and Lynx request it OK as it must.

Case for D-Link DWL-2100AP:

 DWL-2100AP

[Blank lines here]

Commands: Use arrow keys to move, '?' for help, 'q' to quit, '<-' to go back.
  Arrow keys: Up and Down to move.  Right to follow a link; Left to go back.
 H)elp O)ptions P)rint G)o M)ain screen Q)uit /=search [delete]=history list

Case for D-Link DAP-2310 :

 REFRESH(0 sec): http://192.168.1.231/index.php

[Blank lines here]

Commands: Use arrow keys to move, '?' for help, 'q' to quit, '<-' to go back.
  Arrow keys: Up and Down to move.  Right to follow a link; Left to go back.
 H)elp O)ptions P)rint G)o M)ain screen Q)uit /=search [delete]=history list

This is the GUI first screen (the browser pops up a separate credentials window) for DWL-2100AP (older) model:

---

And this one is the D-Link DAP-2310 (credentials inside the web page):

---

Is there a way for Lynx to access these interfaces?

Further tests:

  • Adding -auth=ID:PASSWD to the lynx IP command, with same results.

Further data about the interfaces:

  • It seems both devices use Java.

This is the starting HTML, obtained with curl, that DWL-2100AP seems to send:

<html><head>
<script src="jsMain.js"> </script>
<title>DWL-2100AP</title></head>

<script language='JavaScript'>
document.cookie = 'RpWebID=3c26d7c1';
</script>
<script language='JavaScript'>
function JumpToHmain(){location.replace('/html/HomeWizard.html');}window.setTimeout('JumpToHmain()',1);</script>

Starting web page for DWL-2100AP (after inputing credentials):

http://IPAddress/html/HomeWizard.html

If I try to download it with curl (whether be it using -u username:password or not):

<html>
<head>
<title>Object Not Found</title></head><body>
<h1>Object Not Found</h1>The requested URL '/html/HomeWizard.html' was not found on the RomPager server.<p>Return to <A HREF="">last page</A><p>
</body></html>

Starting web page for DAP-2310 (requesting credentials page):

http://IPAddress/login.php

Attempt to reboot the DWL-2100AP via WGet (direct URL):

    luis@Fresoncio:~$ wget http://admin:MyEditedPassword@192.168.1.232/Forms/RESET_Switch
 converted 'http://admin:EditedPassword@192.168.1.232/Forms/RESET_Switch?FlagForReboot=' (ANSI_X3.4-1968) -> 'http://admin:MySecretPassword@192.168.1.232/Forms/RESET_Switch?FlagForReboot=' (UTF-8)
    --2016-06-07 00:46:42--  http://admin:*password*@192.168.1.232/Forms/RESET_Switch?FlagForReboot=
    Connecting to 192.168.1.232:80... connected.
    HTTP request sent, awaiting response... 303 See Other
    Location: http://192.168.1.232/html/HomeWizard.html [following]
    converted 'http://192.168.1.232/html/HomeWizard.html' (ANSI_X3.4-1968) -> 'http://192.168.1.232/html/HomeWizard.html' (UTF-8)
    --2016-06-07 00:46:42--  http://192.168.1.232/html/HomeWizard.html
    Reusing existing connection to 192.168.1.232:80.
    HTTP request sent, awaiting response... 404 Not Found
    2016-06-07 00:46:42 ERROR 404: Not Found.

Lynx does not report of any need to accept cookies when browsing to DWL-2100AP.

The WireShark/TCPDump capture for the reboot attempt shows a GET to http://192.168.1.232/html/HomeWizard.html with the description Authorization: Basic XXXXXXXXXX and just below Credentials: admin:MyEditedPassword. I think this could be Base64 encoding.

... and then I try WGet with --post-data for RpWebId=3c268b4c and FlagForReboot=&Submit=+Restart+ :

~$ wget 192.168.1.232/Forms/RESET_Switch -post-data='RpWebId=3c268b4c' --post-data='FlagForReboot=&Submit=+Restart+'
converted 'http://192.168.1.232/Forms/RESET_Switch' (ANSI_X3.4-1968) -> 'http://192.168.1.232/Forms/RESET_Switch' (UTF-8)
--2016-06-07 10:29:25--  http://192.168.1.232/Forms/RESET_Switch
Connecting to 192.168.1.232:80... connected.
HTTP request sent, awaiting response... 303 See Other
Location: http://192.168.1.232/html/HomeWizard.html [following]
converted 'http://192.168.1.232/html/HomeWizard.html' (ANSI_X3.4-1968) -> 'http://192.168.1.232/html/HomeWizard.html' (UTF-8)
--2016-06-07 10:29:25--  http://192.168.1.232/html/HomeWizard.html
Reusing existing connection to 192.168.1.232:80.
HTTP request sent, awaiting response... 404 Not Found
2016-06-07 10:29:25 ERROR 404: Not Found.

This is the capture for the moment of the login:

GET /html/HomeWizard.html HTTP/1.1
Host: 192.168.1.232
User-Agent: Mozilla/5.0 (X11; Linux armv7l; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.6.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.232/
Cookie: RpWebID=3c267896
Connection: keep-alive
Authorization: Basic YWRtaWAAAAAhQXBpYQ==

The password part is the final YWRta... part, ending on Q== (The AAAAA is mine, in order to obscure the real password). If I do echo YWRtaWAAAAAhQXBpYQ== | base64 --decode the shell gives me admin:MyPassword.

This is the reboot device page:

Reboot Management

This is my attempt (see JigglyNaga answer) to access the reboot device page via CURL without sending the FlagForReboot data:

$ IP_ADDRESS=192.168.1.232
$ curl -b "$COOKIE" -u "admin:MySecretPassword" $IP_ADDRESS/html/MntRestartSystem.html
<html><head>... etc

And this one sending the FlagForReboot data (I would swear they are the same):

$ IP_ADDRESS=192.168.1.232
$ curl -b "$COOKIE" -u "admin:MySecretPassword" --data "FlagForReboot=&Submit=+Restart+" $IP_ADDRESS/html/MntRestartSystem.html
<html><head>
<title>DWL-2100AP</title><meta HTTP-EQUIV="Content-Type" content="text/html; charset=iso-8859-1">
<LINK REL=stylesheet TYPE="text/css" HREF="web_style.css">
<script language="JavaScript" src="jsMain.js"></script>
<script language="JavaScript">

function ShowMessage(s){
    //  alert("Switch is rebooting and Web will be disconnected!");
  var Msg='Device will reboot and web will be disconnected! Continue?';
  if(confirm(Msg))
  {
    return true;
  }
  else
    return false;
}
</script>
<style type="text/css">
font{
font-family:"Arial";
font-size:10pt;
}
</style>
</head><body BGCOLOR=#FFFFFF leftmargin="0" topmargin="0" onLoad="Change_Device_Name()">
<table width="75%" border="0" cellspacing="0" cellpadding="0" align=center>
  <tr>
    <td><div align=center><img id="img_logo" src="" width="765" height="95"></div></td></tr><tr>
    <td><table width=765 border=0 cellpadding=0 cellspacing=0 align=center>
        <tr>
          <td rowspan=9 width="20" background="/Images/down_01.gif">&nbsp; </td><td rowspan=2 width="133"> <img id="img_ap" src="" width=133 height=75></td><td rowspan=2 width="25" background="/Images/down_03.jpg">&nbsp; </td><td width="21"> <img src="/Images/tools_04.jpg" width=21 height=49></td><td width="522"> <img src="/Images/tools_over_05.jpg" width=522 height=49 usemap="#MapMap" border="0"></td><td width="19"> <img src="/Images/tools_06.jpg" width=19 height=49></td><td width="25" background="/Images/down_11.gif">&nbsp; </td></tr><tr>
          <td width="21" background="/Images/down_14.gif">&nbsp; </td><td rowspan=8 width="522" valign=top>
<FORM METHOD="POST" ACTION="/Forms/RESET_Switch"><INPUT TYPE="HIDDEN" NAME="FlagForReboot" VALUE="" id="FlagForReboot">              <table width="100%" border="0" height="100">
                 <tr >
                  <td colspan=2 align=left height="24" bordercolorlight="#FFFFFF" bordercolordark="#000000"><b><font face=Arial color=#8bacb1 size=2>
                    System Settings</font> </b></td></tr><tr>
          <td align=left height="20" width=200>
            <font face=Arial size=2> Apply Settings and Restart</font>
           </td><td><INPUT TYPE="SUBMIT" NAME="Submit" VALUE=" Restart " onClick="return ShowMessage()">            </td></tr></table></form><FORM METHOD="POST" ACTION="/Forms/RESTORE_Switch"><INPUT TYPE="HIDDEN" NAME="FlagForReboot" VALUE="" id="FlagForReboot">              <table width="100%" border="0" height="110">

        <tr>
                  <td align=left height="25" width=200>
                        <font face=Arial size=2>  Restore factory settings  </font>
                  </td><td><INPUT TYPE="SUBMIT" NAME="Submit" VALUE=" Restore " onClick="return ShowMessage()">                   </td></tr><tr>
<td height=20 colspan=2>
<div align=right><a href=/html/help_tools.html#02 target=_blank><img src=/Images/help_p.jpg width=36 height=52 border=0></a></div></td></tr></table></form></td><td width="19"> <img src="/Images/down_10.jpg" width=19 height=26></td><td width="25" background="/Images/down_11.gif">&nbsp; </td></tr><tr>
          <td class="style1" width="133" height="57"  align=center onClick="javascript:Link('MgtUserAccount.html')">Admin</td><td width="25" background="/Images/down_03.jpg" height="42">&nbsp; </td><td width="21" background="/Images/down_14.gif" height="42">&nbsp; </td><td width="19" background="/Images/down_40.gif" height="42">&nbsp; </td><td width="25" background="/Images/down_11.gif" height="42">&nbsp; </td></tr><tr>
          <td class="style2"  width="133" height="57" valign=middle align=center onClick="javascript:Link('MntRestartSystem.html')">System</td><td width="25" background="/Images/down_03.jpg">&nbsp; </td><td width="21" background="/Images/down_14.gif">&nbsp; </td><td width="19" background="/Images/down_40.gif">&nbsp; </td><td width="25" background="/Images/down_11.gif">&nbsp; </td></tr><tr>
          <td class="style1"  width="133" height="57" valign=middle align=center onClick="javascript:Link('MntUpdateFirmware.html?1')">Firmware</td><td width="25" background="/Images/down_03.jpg">&nbsp; </td><td width="21" background="/Images/down_14.gif">&nbsp; </td><td width="19" background="/Images/down_40.gif">&nbsp; </td><td width="25" background="/Images/down_11.gif">&nbsp; </td></tr><tr>
          <td class="style1"  width="133" height="57" valign=middle align=center onClick="javascript:Link('MntConfigurationFile.html?0,0,0,0,0,0,0,0,0')">Cfg File</td><td width="25" background="/Images/down_03.jpg" height="6">&nbsp; </td><td width="21" background="/Images/down_14.gif" height="6">&nbsp; </td><td width="19" background="/Images/down_40.gif" height="6">&nbsp; </td><td width="25" background="/Images/down_11.gif" height="6">&nbsp; </td></tr>        <tr>
          <td width="133" height="57" valign=middle align=center  background="/Images/down_37.gif">&nbsp;</td><td width="25" background="/Images/down_03.jpg">&nbsp;</td><td width="21" background="/Images/down_14.gif">&nbsp; </td><td width="19" background="/Images/down_40.gif">&nbsp; </td><td width="25" background="/Images/down_11.gif">&nbsp; </td></tr>        <tr>
          <td width="133" background="/Images/down_37.gif">&nbsp;</td><td width="25" background="/Images/down_03.jpg">&nbsp;</td><td width="21" background="/Images/down_14.gif">&nbsp; </td><td width="19" background="/Images/down_40.gif">&nbsp; </td><td width="25" background="/Images/down_11.gif">&nbsp; </td></tr>
        <tr>
          <td width="133" background="/Images/down_37.gif">&nbsp;</td><td width="25" background="/Images/down_03.jpg">&nbsp;</td><td width="21" background="/Images/down_14.gif">&nbsp; </td><td width="19" background="/Images/down_40.gif">&nbsp; </td><td width="25" background="/Images/down_11.gif">&nbsp; </td></tr><tr>
          <td colspan=6 rowspan=2> <img src="/Images/down_43.jpg" width=740 height=44></td><td width="25"> <img src="/Images/down_45.gif" width="25" height="17"></td></tr><tr>
          <td width="25"> <img src="/Images/down_44.gif" width=25 height=27></td></tr></table></td></tr></table><map id="MapMap" name="MapMap">
  <area shape="rect" coords="17,17,82,45" href="/html/HomeWizard.html" target="_self"/>
  <area shape="rect" coords="109,18,205,42" href="/html/CfgWLanParam.html?1" target="_self"/>
  <area shape="rect" coords="232,19,289,46" href="/html/MgtUserAccount.html" target="_self"/>
  <area shape="rect" coords="346,18,405,45" href="/html/DeviceInfo.html" target="_self"/>
  <area shape="rect" coords="455,18,501,47" href="/html/help_men.html" target="_self"/>
</map>

</body></html>

And this is its TCPDump capture (the part that seems relevant) for that moment, as shown on WireShark:

Frame 4: 517 bytes on wire (4136 bits), 517 bytes captured (4136 bits)
Ethernet II, Src: 00:00:00_00:09:77 (00:00:00:00:09:77), Dst: D-LinkIn_24:f7:6d (c8:d3:a3:24:f7:6d)
Internet Protocol Version 4, Src: 192.168.1.99, Dst: 192.168.1.232
Transmission Control Protocol, Src Port: 44981 (44981), Dst Port: 80 (80), Seq: 1, Ack: 1, Len: 451
Hypertext Transfer Protocol
    GET /html/MntRestartSystem.html HTTP/1.1\r\n
    Host: 192.168.1.232\r\n
    User-Agent: Mozilla/5.0 (X11; Linux armv7l; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.6.0\r\n
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n
    Accept-Language: en-US,en;q=0.5\r\n
    Accept-Encoding: gzip, deflate\r\n
    Referer: http://192.168.1.232/html/MgtUserAccount.html\r\n
    Cookie: RpWebID=3c26e560\r\n
    Authorization: Basic YWRtaW46VmlhQXBpYQ==\r\n
    Connection: keep-alive\r\n
    \r\n
    [Full request URI: http://192.168.1.232/html/MntRestartSystem.html]
    [HTTP request 1/2]
    [Response in frame: 15]
    [Next request in frame: 17]

0000   47 45 54 20 2f 68 74 6d 6c 2f 4d 6e 74 52 65 73  GET /html/MntRes
0010   74 61 72 74 53 79 73 74 65 6d 2e 68 74 6d 6c 20  tartSystem.html 
0020   48 54 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20  HTTP/1.1..Host: 
0030   31 39 32 2e 31 36 38 2e 31 2e 32 33 32 0d 0a 55  192.168.1.232..U
0040   73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c  ser-Agent: Mozil
0050   6c 61 2f 35 2e 30 20 28 58 31 31 3b 20 4c 69 6e  la/5.0 (X11; Lin
0060   75 78 20 61 72 6d 76 37 6c 3b 20 72 76 3a 33 38  ux armv7l; rv:38
0070   2e 30 29 20 47 65 63 6b 6f 2f 32 30 31 30 30 31  .0) Gecko/201001
0080   30 31 20 46 69 72 65 66 6f 78 2f 33 38 2e 30 20  01 Firefox/38.0 
0090   49 63 65 77 65 61 73 65 6c 2f 33 38 2e 36 2e 30  Iceweasel/38.6.0
00a0   0d 0a 41 63 63 65 70 74 3a 20 74 65 78 74 2f 68  ..Accept: text/h
00b0   74 6d 6c 2c 61 70 70 6c 69 63 61 74 69 6f 6e 2f  tml,application/
00c0   78 68 74 6d 6c 2b 78 6d 6c 2c 61 70 70 6c 69 63  xhtml+xml,applic
00d0   61 74 69 6f 6e 2f 78 6d 6c 3b 71 3d 30 2e 39 2c  ation/xml;q=0.9,
00e0   2a 2f 2a 3b 71 3d 30 2e 38 0d 0a 41 63 63 65 70  */*;q=0.8..Accep
00f0   74 2d 4c 61 6e 67 75 61 67 65 3a 20 65 6e 2d 55  t-Language: en-U
0100   53 2c 65 6e 3b 71 3d 30 2e 35 0d 0a 41 63 63 65  S,en;q=0.5..Acce
0110   70 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69  pt-Encoding: gzi
0120   70 2c 20 64 65 66 6c 61 74 65 0d 0a 52 65 66 65  p, deflate..Refe
0130   72 65 72 3a 20 68 74 74 70 3a 2f 2f 31 39 32 2e  rer: http://192.
0140   31 36 38 2e 31 2e 32 33 32 2f 68 74 6d 6c 2f 4d  168.1.232/html/M
0150   67 74 55 73 65 72 41 63 63 6f 75 6e 74 2e 68 74  gtUserAccount.ht
0160   6d 6c 0d 0a 43 6f 6f 6b 69 65 3a 20 52 70 57 65  ml..Cookie: RpWe
0170   62 49 44 3d 33 63 32 36 65 35 36 30 0d 0a 41 75  bID=3c26e560..Au
0180   74 68 6f 72 69 7a 61 74 69 6f 6e 3a 20 42 61 73  thorization: Bas
0190   69 63 20 59 57 52 74 61 57 34 36 56 6d 6c 68 51  ic YWRtaW46VmlhQ
01a0   58 42 70 59 51 3d 3d 0d 0a 43 6f 6e 6e 65 63 74  XBpYQ==..Connect
01b0   69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d  ion: keep-alive.
01c0   0a 0d 0a                                         ...

Now trying to "press" that Reset button via CURL (same result:

$ curl -v -u "admin:MySecretPassword" -b "$COOKIE" --data "FlagForReboot=&Submit=+Restart+" $IP_ADDRESS/Forms/RESET_Switch
* Hostname was NOT found in DNS cache
*   Trying 192.168.1.232...
* Connected to 192.168.1.232 (192.168.1.232) port 80 (#0)
* Server auth using Basic with user 'admin'
> POST /Forms/RESET_Switch HTTP/1.1
> Authorization: Basic YWRtaW46VmlhQXBpYQ==
> User-Agent: curl/7.38.0
> Host: 192.168.1.232
> Accept: */*
> Cookie: RpWebID=3c270622
> Content-Length: 31
> Content-Type: application/x-www-form-urlencoded
>
* upload completely sent off: 31 out of 31 bytes
< HTTP/1.1 303 See Other
< Location: http://192.168.1.232/html/HomeWizard.html
< Content-Length: 0
* Server Allegro-Software-RomPager/4.06 is not blacklisted
< Server: Allegro-Software-RomPager/4.06
<
* Connection #0 to host 192.168.1.232 left intact

A rether different results with -L option for CURL:

$ curl -b "$COOKIE" --data "FlagForReboot=&Submit=+Restart+" $IP_ADDRESS/Forms/RESET_Switch -L
<html><head>
<title>DWL-2100AP</title><meta http-equiv="content-type" content="text/html; charset=iso-8859-1"/>
<link rel=stylesheet type="text/css" href="web_style.css">
<script type="text/javascript" src="jsMain.js"></script>
<script type="text/javascript" src="WizardScript.js"></script>
<style type="text/css">
font{
font-family:"Arial";
font-size:10pt;
}

td.h30{
height:30px;
}

td.h60{
height:60px;
}
td.h80{
height:80px;
}
</style>
</head><body bgcolor="#ffffff" topmargin="0" onLoad="InitialSettings()">
<table border="0" align=center cellpadding="0" cellspacing="0">
        <tr>
                <td><img id="img_logo" src="" alt=""></td></tr><tr>
                <td><table border="0" align=center cellspacing="0" cellpadding="0">
                                <tr><!-- row 1 -->
                                        <td width=20 rowspan=3 background="/Images/down_01.gif"></td><td width=133 rowspan=2><img id="img_ap" src="" border="0" alt=""/></td><td width=25 background="/Images/down_03.jpg"></td><td width=21 background="/Images/down_04.jpg"></td><td width=522><img src="/Images/down_05.jpg" border="0" usemap="#MapMap"/></td><td width=19 background="/Images/down_06.jpg"></td><td width=25 background="/Images/down_11.gif"></td></tr><tr><!-- row 2 -->
                                        <td background="/Images/down_03.jpg"></td><td height="26" background="/Images/down_14.gif"></td><td rowspan=3 valign=top>

<FORM METHOD="POST" ACTION="/Forms/FormWizard"><table border="0" width="100%" align=center cellpadding="0" cellspacing="0">
<tr>
<td colspan=2>
<!-- Beginning of Contents -->
<table width=510 border="0">
  <tr>
    <td colspan=2>
      <font color="#8bacb1"><b>Setup Wizard</b></font>
     <INPUT TYPE="HIDDEN" NAME="Run_Wizard" VALUE="0" id="Run_Wizard">    </td></tr>  <tr>
    <td height="150">
      <b><font>
      The <span id="APName0"></span>&nbsp;is a <span id="Device_Type"></span>.
      The setup wizard will guide you through the configuration of the
      <span id="APName1"></span>. The <span id="APName2"></span>'s easy
      setup will allow you to have wireless access within minutes.
      Please follow the setup wizard step by step to configure
      the <span id="APName3"></span>.
      </font></b>
    </td></tr><tr>
    <td>&nbsp;</td></tr><tr>
    <td align=center>
<INPUT TYPE="SUBMIT" NAME="Submit" VALUE=" Run Wizard " id="Run_Wizard" onClick="formSubmit(1)" align=right>    </td></tr><tr>
    <td align=right>
      <a href="help_home.html#01" target=_blank>
      <img src="/Images/help_p.jpg" width="36" height="52" border="0">
      </a></td></tr>

</table><!-- End of Contents -->
</td></tr></table></form>
                                        </td><td background="/Images/down_10.jpg"></td><td background="/Images/down_11.gif"></td></tr><tr><!-- row 3 -->
                                        <td valign=top background="/Images/down_37.gif">
                                                <table width="100%" border="0" cellspacing="0" cellpadding="0" align=center>
                                                        <tr>
                                                                <td class="style2" align=center valign=middle onClick="javascript:Link('HomeWizard.html')">Wizard</td></tr><tr>
                                                                <td class="style1" align=center valign=middle onClick="javascript:Link('Wireless.html?1')">Wireless</td></tr><tr>
                                                                <td class="style1" align=center valign=middle onClick="javascript:Link('CfgIpSetup.html')">LAN</td></tr></table></td><td background="/Images/down_03.jpg"></td><td background="/Images/down_14.gif"></td><td background="/Images/down_40.gif"></td><td background="/Images/down_11.gif"></td></tr><tr><!-- row 4 -->
                                        <td height="150" background="/Images/down_37.gif"></td><td background="/Images/down_37.gif"></td><td background="/Images/down_03.jpg"></td><td background="/Images/down_14.gif"></td><td background="/Images/down_40.gif"></td><td background="/Images/down_11.gif"></td></tr><tr><!-- row 5 -->
                                        <td colspan=6 rowspan=2><img src="/Images/down_43.jpg" border="0"></td><td><img src="/Images/down_45.gif" border="0"></td></tr><tr>
                                        <td><img src="/Images/down_44.gif" border="0"></td></tr></table></td></tr></table><map id="MapMap" name="MapMap">
  <area shape="rect" coords="17,17,82,45" href="/html/HomeWizard.html" target="_self"/>
  <area shape="rect" coords="109,18,205,42" href="/html/CfgWLanParam.html?1" target="_self"/>
  <area shape="rect" coords="232,19,289,46" href="/html/MgtUserAccount.html" target="_self"/>
  <area shape="rect" coords="346,18,405,45" href="/html/DeviceInfo.html" target="_self"/>
  <area shape="rect" coords="455,18,501,47" href="/html/help_men.html" target="_self"/>
</map>
<script type="text/javascript">
var Run_Wizard = document.getElementById("Run_Wizard");
var NewPwd = document.getElementById("NewPwd");
var CfmNewPwd = document.getElementById("CfmNewPwd");
var channel = document.getElementById("channel");
var WizardRootSsid = document.getElementById("WizardRootSsid");
var no = document.getElementById("No");
var wpa = document.getElementById("wpa");
var psk = document.getElementById("psk");
var keytype    = document.getElementById("Wizard_KeyType");
var KeySize1 = document.getElementById("KeySize1");
var KeySize2 = document.getElementById("KeySize2");
var KeySize3 = document.getElementById("KeySize3");
var key = document.getElementById("Key");
var passphrase = document.getElementById("passphrase");
var cipher     = document.getElementById("cipher");
var groupkey   = document.getElementById("groupkey");
</script>

</body></html>

After that, there will be a confirmation screen for reboots:

-

I can add more data upon requests.

  • The restart request includes both a cookie RpWebId=3c269679 and some POST data FlagForReboot=&Submit=+Restart+, while your request has neither. Look for --post-data and --load-cookies/--save-cookies in the wget manual . And yes, please include the earlier dump. – JigglyNaga Jun 07 '16 at 07:28
  • But I can not perform login, @JigglyNaga . Or so it seems. Whether do I use Lynx, WGet or Curl, if I can not log in from CLI, how could I send a restart submit? Even the cookie is not stored. Added example with --save-cookies.. – Sopalajo de Arrierez Jun 07 '16 at 08:25
  • Oh, the cookie is set by JavaScript, and that's why lynx/wget/curl won't see it. You'll have to give that cookie in a form that wget or curl understand. And please include the capture from when you successfully logged in using a browser (obscuring the password if you want). – JigglyNaga Jun 07 '16 at 08:56
  • Done including the GUI browser capture for the loggin successful, @JigglyNaga . Of course there is Java inside; I told it at the beginning. – Sopalajo de Arrierez Jun 07 '16 at 09:30
  • It's possible that sending auth details with wget requires --auth-no-challenge. Sometimes the server doesn't request it. Also, that's Javascript, not Java. – JigglyNaga Jun 07 '16 at 09:50
  • All right. Do you mean wget 192.168.1.232/Forms/RESET_Switch -post-data='RpWebId=3c268b4c' --post-data='FlagForReboot=&Submit=+Restart+' --auth-no-challenge directly as first command? No need to obtain the cookie first? I have heard that cookie could las only a few minutes. – Sopalajo de Arrierez Jun 07 '16 at 09:53
  • RpWebId=... is a cookie, not POST-data. See the links in my comment about getting wget and curl to understand cookies. And please clarify which of the APs you're using, as they seem to need different authentication methods. – JigglyNaga Jun 07 '16 at 09:58

2 Answers2

2

Unfortunately many routers these days require javascript, which lynx does not support.

But as an alternate method you should be able to use tunnels on ssh, and use a real browser to get to it. For instance, if you tunnel port 8888 to port 80 on the IP of your router ( example, say 192.168.1.1:80 ). After establishing your ssh connection, on your local machine, on a 'real' browser (a graphical one with js) browse to http://127.0.0.1:8888 to get to the normal web page of the remote router. This is using your remote ssh host as a proxy.

With browsers like firefox you can actually pretty easily set it up to use a SOCKS proxy, and let SSH set up the SOCKS proxy for you, and transparently use the remote host as your network proxy, including whatever access it has from its local net to the router. Look for how to set up SOCKS with your particular SSH client (usually called dynamic port forwarding), and how to set up proxy connectivity for firefox in its connectivity dialog. Then eventually you should be able to tell firefox to use a SOCKS proxy at 127.0.0.1:1080 (for example)

(Lynx might get one step further if you tried a url like http://admin:password@192.168.1.230 , but I suspect you'd still run into js problems soon)

infixed
  • 887
  • Indeed, by SSH-tunneling I can arrive to the remote web interface. I didn't tell on the original question, but my final goal is to script the keystrokes (just for rebooting the APs) on the remote network without need of my live connection, so this method is not valid for me. Thanks for the http://admin:password method, but it is not working neither. Anyway, your answer is a valid solution. – Sopalajo de Arrierez Jun 06 '16 at 15:42
  • If you find the REBOOT link on the right page, sometimes you can reverse engineer the HTML and construct a http://admin:password@192.168.1.230/whateverthelinkwas URL to hit the same action from outside the GUI. It'd be a kludge, but sometimes its possible – infixed Jun 06 '16 at 15:51
  • Indeed, the reboot page is a HTML one, but it seems the Restart button starts some sort of java script. It seems some time of Submit form, but I am not so used to Java programming to extract a possible direct link. :-( – Sopalajo de Arrierez Jun 06 '16 at 16:21
  • tcpdump/Wireshark it as you submit a reboot request and see if you can find a good GET or POST http exchange. You might google to see who has been down this road befor, for example http://www.dslreports.com/forum/r14601971-How-to-automate-router-restart suggests http://192.168.0.2/restart.cgi – infixed Jun 06 '16 at 17:22
  • Depending on how much you want to get into this, often times you can grab a firmware update, and if its a straight binary, use the strings utility to look inside for interesting URLs and HTTP fragments. If you find reverse engineering fun that is. – infixed Jun 06 '16 at 21:17
  • I have captured traffic, and I have found a POST HTTP package named POST /Forms/RESET_Switch HTTP/1.1 (application/x-www-form-urlencoded). Could you please give any advices on how to use that? I am not very used to WireShark. Maybe replying it with any tool when desired? – Sopalajo de Arrierez Jun 06 '16 at 22:15
  • If you look deeper in the packet, you should see form parameters being set for the form. Many implementations of webservers like this are tolerant of format. You can often take a POST and change it to a GET. Like a POST to http://host/page containing a form parameters FOO set to 1234 can often be treated identically to using wget http://host/page?FOO=1234. (which does a GET style http transaction) Why don't you dump that TCP stream with that POST message in it, and add it to your question if its not too long. – infixed Jun 06 '16 at 22:33
  • Actually a dlink document about a different model ftp.dlink.ru/pub/Wireless/.../Release%20Note%20DWL3260_20070321.doc (Russia, go figure), refers to that form and says the user can just go to it to reset that unit. Why don't you try browsing to http://admin:password@192.168.1.231/Forms/RESET_Switch and see if it resets the unit – infixed Jun 06 '16 at 22:41
  • Done. I can not see the password nor user ("admin") anywhere. I have tried repeating that packet with tcpreplay, but I am not sure if it worked: the device stops responding to pings a few seconds, but the log within does not reports the usual Warm start at time H:M:S. – Sopalajo de Arrierez Jun 06 '16 at 22:42
  • The http://admin:password@192.168.1.231//Forms/RESET_Switch yields some 404 Not Found error trying it with WGet. None of the http://admin:password URLs seem to work until now. I think the authentification method does not work that way. – Sopalajo de Arrierez Jun 06 '16 at 22:45
  • Perhaps http://admin:password@192.168.1.231/Forms/RESET_Switch?FlagForReboot=&Submit=+Restart+ – infixed Jun 06 '16 at 22:45
  • There are so many ways they could do authentication. It'll boil down to a cookie. But I'm not sure how you'll get one automatically. I'll have to think on it. – infixed Jun 06 '16 at 22:47
  • Thanks for your help. Added your direct URL attempt to original post. Lynx does not report of any need to accept cookies when browsing to the DWL-2100AP. – Sopalajo de Arrierez Jun 06 '16 at 22:51
2

Many routers return pages that lynx and other terminal-based browsers can't handle.

You could write a web-scraping script to do it. Expanding on this web-scraping howto, but without going into as much detail as the cURL guide to HTTP scripting, my approach is as follows:


1 - Record what a (supported) browser does

You can use a packet capture tool like tcpdump(1) or wireshark, or something in-browser like Firefox's Developer Tools. tcpdump/wireshark capture everything, in the portable but unreadable pcap format; the in-browser data may be easier to follow, especially if the responses are compressed. Also save copies of the individual pages visited, they might be needed for step 3.

2 - Send the same requests from the command line

For each HTTP request produced in step 1, figure out how to send it with curl or wget, then put it in the script.

You may need to look up header descriptions in the HTTP specification and scan through the extensive options in the curl or wget documentation, but if all else fails, both tools let you send any header you want (curl -H "Name: Value", wget --header "Name: Value"). Confirm what's being sent and received with curl -v / wget -d. If a request doesn't result in the same response as in step 1, you've probably missed something.

If you've been working on one of the later requests for a while, it's possible that the site/device has timed out or invalidated your session, and you first need to repeat some earlier requests (such as logging in).

If, after sending the final request, you get the required outcome - excellent, proceed to step 4.

3 - Update anything that changes

If the exact same HTTP request doesn't give the same response, then some part of the request is no longer valid, and needs to change. Repeat step 1, recording the same operation again, and look at any differences in the requests and responses.

Everything in the requests comes from somewhere. You have to track down the origin of each part that changes. Look through all the HTTP responses (whole HTML pages, JavaScript, CSS, snippets of JSON) to find where the string comes from. The page names and GET/POST parameters mostly come from the HTML, and Cookies from HTTP headers, but JavaScript can set any of them.

Once you've tracked it down, you need to automatically find the new value in future: extract unpredictable tokens from the retrieved page with sed/awk/your text-processing language of choice; generate current timestamps with date +"format".

4 - (Optional) Remove the unnecessary parts

The browser probably generated dozens of requests, and it's unlikely you need to send all of them to get the same end result. For example, the images and CSS are of no interest if you're not displaying the page. Try removing any requests that don't look important, and see if the script still works. With experience, you'll get a feeling for which requests are optional.


Using the information you've posted so far, logging in on the DAP-2310 is going to need a POST request like

wget $IP_ADDRESS/login.php --save-cookies cookies.txt --keep-session-cookies \
  --post-data "ACTION_POST=login&f_date=MM/DD/YY&f_time=HH:MM:SS&LOGIN_USER=username&LOGIN_PASSWD=password&login=+Login+"

(using current date and time, formatted by date(1)) but there may still be more steps involved.

The DWL-2100AP packet captures show it's using HTTP Basic Authentication, combined with a custom cookie set by JavaScript. For that, you'll need to scrape the cookie from the first page before logging in:

# obtain the cookie
COOKIE=$(curl $IP_ADDRESS |grep "cookie = "|cut -d"'" -f2)

# log in
curl -b "$COOKIE" --anyauth -u "admin:$PASSWORD" $IP_ADDRESS/html/HomeWizard.html 

# fetch the restart form; may not be necessary
curl -b "$COOKIE" $IP_ADDRESS/html/MntRestartSystem.html

# send the restart request
curl -b "$COOKIE" --data "FlagForReboot=&Submit=+Restart+" $IP_ADDRESS/Forms/RESET_Switch
JigglyNaga
  • 7,886
  • Maybe you could provide a tested working example with another access point device? I have updated the original question with extra data about the web interface. – Sopalajo de Arrierez Jun 06 '16 at 21:03
  • A good tutorial about it would also be welcome. – Sopalajo de Arrierez Jun 06 '16 at 21:19
  • Your script is very interesting, thanks you. But I don't know how to log into any of the two devices via WGet or Curl, even adding the login data to the command line. Details are shown on my original post. Maybe it is due to Java? – Sopalajo de Arrierez Jun 06 '16 at 23:13
  • Added new data to the original post about some possible Base64 encoding for sending the password, after analyzing the TCPDump capture of a login and a reboot. Maybe that could solve the login via Curl or WGet issue. – Sopalajo de Arrierez Jun 06 '16 at 23:33
  • Well, so I said at the beginning of my original question that maybe this question should have been splitted in two. I propose to deal with the DWL-2100AP (HTTP Basic with custom JavaScript cookie), and, if solved, I could create a new question for the DAP-2310, as long as they are so different. – Sopalajo de Arrierez Jun 07 '16 at 18:49
  • Your CURL code to connect to DWL-2100AP worked fine (a curious thing: I had to retry, as long as the first attempt failed... but the same hapens to when loging into the web interface, so I must assume it is some bug of the device :-P ) . Same (good) results when browsing to the (final) objective of this question: curl -b "$COOKIE" -u "admin:MyEditedPassword" 192.168.1.232/html/MntRestartSystem.html . Now all we need is to figure out how to send the reboot order. Do you need more data? The restart button has no direct link. Maybe sending the FlagForReboot=&Submit=+Restart+? How? – Sopalajo de Arrierez Jun 07 '16 at 19:45
  • What kind of failure does it give, the first time? That might be normal HTTP auth. The "FlagForReboot" etc. is POST data, so (after logging in successfully) please try curl -b "$COOKIE" -u "admin:password" --data "FlagForReboot=&Submit=+Restart+" $ROUTER_IP/html/MntRestartSystem.html. If that fails, we may need to look in the HTML of the page MntRestartSystem.html. – JigglyNaga Jun 07 '16 at 23:08
  • It seems to fail only sometimes with a small html code that ends: This object on the RomPager server is protected. I wouldn't bother about it, I think it is a rather random failure. – Sopalajo de Arrierez Jun 08 '16 at 02:17
  • I think your last line works, but there is a confirmation message on the HTML returned: var Msg='Device will reboot and web will be disconnected! Continue?'; inside a function named function ShowMessage(s){. I would add it to my original post, but... I have reached the characters limit! X-D . What could we do? This message appears, of course, on the web interface as a small window (the rest of the screen gets greyed). – Sopalajo de Arrierez Jun 08 '16 at 02:23
  • Added confirmation screen image. Mora data on the html: if(confirm(Msg)){return true;} else return false;, just below the reboot confirmation message (damn... there must be some way to enlarge my post :-P ). – Sopalajo de Arrierez Jun 08 '16 at 02:29
  • It is all right, JigglyNaya, edit the original question. As I told you before, I have changed the title to just "CLI reboot DWL-2100AP", so delete whatever would not be neccessay for that. I will later add the two pcap captures for reboot and confirmation. – Sopalajo de Arrierez Jun 08 '16 at 07:32
  • Fine then, Jiggly. Added new info: the corresponding to the access to the Reboot Management Page. I think we must guess now how to press that "Reset" button. – Sopalajo de Arrierez Jun 11 '16 at 15:36
  • Maybe we should go for the /Forms/RESET_Switch part on the HTML code? Note it seems no differences between sending or not the reboot flag on the CURL line. – Sopalajo de Arrierez Jun 11 '16 at 15:58
  • @SopalajodeArrierez Yes, that's the request that you need to reproduce, after logging in. The post-data from those earlier comments, plus the cookie, plus that page. curl -b "$COOKIE" --data "FlagForReboot=&Submit=+Restart+" $ROUTER_IP/Forms/RESET_Switch – JigglyNaga Jun 11 '16 at 16:04
  • Done. But nothing happens. No output on console. Strange. But the URL seems to be correct: if I change Switch to something like Switc the router (access point, actually) answers URL not found on the RomPager server. Do you want some TCPDump scan in order to guess what happened? Or maybe we must change the CURL command? – Sopalajo de Arrierez Jun 12 '16 at 03:25
  • No output? Use -v to see the exact request and response. When you click Restart + Confirm in the browser, do you see another page, telling you that it's rebooting? See step 2 of my answer - you have to make the script more like the browser. Try copying more of the headers (maybe Referer, -e) and including earlier requests (such as fetching /html/MntRestartSystem.html before the final POST). Don't stop until tcpdump of the script and the browser looks the same. – JigglyNaga Jun 12 '16 at 07:07
  • Added output with -v to question. – Sopalajo de Arrierez Jun 12 '16 at 14:11
  • Indeed, another web page loads telling "Router rebooting" with a time counter decreasing (30 seconds). Wanna capture? – Sopalajo de Arrierez Jun 12 '16 at 14:15
  • Indeed, making the script more like the browser is the important part here. Maybe I could send you some .cap in any manner so we can analyze it? It is not very big, but is still too long to publish it here. – Sopalajo de Arrierez Jun 12 '16 at 14:17
  • The -v output shows a Redirect to /html/HomeWizard.html. The browser follows that automatically (and that should have shown up in your capture), so you should fetch it manually with curl (probably repeating the same cookie and auth options). Also see if any requests are sent when the 30s timeout expires - if so, you'll have to submit that, too. – JigglyNaga Jun 12 '16 at 15:40
  • Or try again with -L in the options, to make it follow the redirect automatically. – JigglyNaga Jun 12 '16 at 15:51
  • Done with -L option. It seems there is now a Javascript at the end. – Sopalajo de Arrierez Jun 13 '16 at 00:51
  • Upsss... it seems the chat does not alert users when somebody answers. There I am again, waiting for you. – Sopalajo de Arrierez Jun 15 '16 at 20:43