/    Sign up×
Community /Pin to ProfileBookmark

Lottery numbers API

I’m looking to grab some lottery numbers from [url]http://www.lotterypost.com/game/232[/url]

They are loaded into the document with Javascript after the page loads, so plain cURL (or equivalents) are out. I found a POST request using firebug after the page loads That looks like this:

[code]
HeadersPostPutResponseCacheHTMLJSON
Response Headersview source
Cache-Control private, max-age=0
Content-Type application/json; charset=utf-8
Server Microsoft-IIS/7.0
X-Powered-By ASP.NET
P3P CP=”IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT”
Date Mon, 30 Aug 2010 17:32:56 GMT
Content-Length 327
Request Headersview source
Host www.lotterypost.com
User-Agent Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8
Accept text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language en-us,en;q=0.5
Accept-Encoding gzip,deflate
Accept-Charset ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive 115
Connection keep-alive
X-Requested-With XMLHttpRequest
Content-Type application/json; charset=utf-8
Referer http://www.lotterypost.com/game/232
Content-Length 0
Cookie ASP.NET_SessionId=wdg3me4ufxg1pkldwqizwvex; g=a=40380.6531313657&b=40420.5784265625&c=/game/232&d=; f=a=40420.5645376736; __utma=130209170.2109681115.1283193723.1283193723.1283193723.1; __utmb=130209170.7.10.1283193723; __utmc=130209170; __utmz=130209170.1283193723.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1974609426-1283193723418; l=ca
[/code]

The response came back as JSON from this request:

[code]
{“d”:[“Sun, Aug 29, 2010|3-2-5-2-4-7″,”Sat, Aug 28, 2010|4-2-5-2-1-4″,”Fri, Aug 27, 2010|2-7-2-6-1-9″,”Thu, Aug 26, 2010|5-0-1-2-4-6″,”Wed, Aug 25, 2010|2-0-3-7-0-1″,”Tue, Aug 24, 2010|6-1-2-8-6-1″,”Mon, Aug 23, 2010|6-3-9-6-0-7″,”Sun, Aug 22, 2010|3-7-1-5-7-7″,”Sat, Aug 21, 2010|3-0-8-3-7-1″,”Fri, Aug 20, 2010|3-4-7-2-4-7”]}[/code]

So I tried pulling it in to my own website using a request to the same URL that the Javascript request was made like this:

[code=php]
$header .= “POST /game.aspx/GetResults HTTP/1.0rn”;
$header .= “Content-Type: application/json; charset=utf-8rn”;
$header .= “Referer: http://www.lotterypost.com/game/”;
$header .= “X-Requested-With: XMLHttpRequestrn”;
$header .= “Content-Length: 0rnrn”;
$fp = fsockopen (‘www.lotterypost.com’, 80, $errno, $errstr, 30);
if(!$fp) {
echo “no dice”;
} else {
$fullstring = ”;
fputs ($fp, $header . $qstring);
while (!feof($fp)) {
$res = fgets ($fp, 1024);
$fullstring .= $res;
}
echo $fullstring;
}
[/code]

But I kept getting back an HTTP 301 redirect….is there any chance I can get this request working or did the developers make the script too secure to accept any outside connections – even when I try to fake the referer heading, etc….?

Any help is greatly appreciated.

EDIT: Apparently the cookie part is quite important. When I disabled cookies in the browser (and am browsing their site), I can see the request returns a 500 error. So what’s the deal with the cookie:

[code]
Cookie ASP.NET_SessionId=wdg3me4ufxg1pkldwqizwvex; g=a=40380.6531313657&b=40420.5784265625&c=/game/232&d=; f=a=40420.5645376736; __utma=130209170.2109681115.1283193723.1283193723.1283193723.1; __utmb=130209170.7.10.1283193723; __utmc=130209170; __utmz=130209170.1283193723.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1974609426-1283193723418; l=ca
[/code]

I notice that every part here where I see 1283193723 it’s a unixtimestamp at the time of the request. Not sure what everything else is……think I can fake it? Anybody up for helping me?

to post a comment
PHP

2 Comments(s)

Copy linkTweet thisAlerts:
@sohguanhSep 02.2010 — 
Cookie ASP.NET_SessionId
[/QUOTE]


I was thinking above name indicate a ASP.NET sessionid which is equivalent in concept with PHP sessionid correct ?

So thinking along the line, how do we "fake" a valid PHP sessionid ? If we can do that then we apply the same concept to the above ASP.NET sessionid.

If I'm not wrong a lot of websites uses sessionid to do tracking and validation at server end. The ability to fake valid sessionid seems to be the key to "trick" those server software to reply to our web request obediently :p
Copy linkTweet thisAlerts:
@criterion9Sep 02.2010 — I'd be careful that you aren't violating any law or terms of use by not using the site/service in the way it was intended. Best practice is to get the content originator to expose an API for the requested data.
×

Success!

Help @aj_nsc spread the word by sharing this article on Twitter...

Tweet This
Sign in
Forgot password?
Sign in with TwitchSign in with GithubCreate Account
about: ({
version: 0.1.9 BETA 5.17,
whats_new: community page,
up_next: more Davinci•003 tasks,
coming_soon: events calendar,
social: @webDeveloperHQ
});

legal: ({
terms: of use,
privacy: policy
});
changelog: (
version: 0.1.9,
notes: added community page

version: 0.1.8,
notes: added Davinci•003

version: 0.1.7,
notes: upvote answers to bounties

version: 0.1.6,
notes: article editor refresh
)...
recent_tips: (
tipper: @AriseFacilitySolutions09,
tipped: article
amount: 1000 SATS,

tipper: @Yussuf4331,
tipped: article
amount: 1000 SATS,

tipper: @darkwebsites540,
tipped: article
amount: 10 SATS,
)...