YMSG16


Server to test with cs129.msg.ac4.yahoo.com

Upon receiving challenge string you need to get response from

https://login.yahoo.com/config/pwtoken_get?src=ymsgr&ts=&login=' . USER . '&passwd=' . PASSWORD . '&chal=' . CHALLENGESTRING

Reponse will look like 

0 
ymsgr=ANOuYEjP8GqsnMOXXZHXXXXXXXJAxsQldMnizg_E- 
partnerid=XJAxsQldMnizg_E-

You need the content of the ymsgr variable then use it to get reponse from

https://login.yahoo.com/config/pwtoken_login?src=ymsgr&ts=&token=ANOuYEjP8GqsnMOJXZHXXXXXXXJAxsQldMnizg_E-

I left the token as it was to make it easier to see. Result contains cookie and crumb in plain text

Login is then sent as normal YMSG

Packet type = Not Sure but probably the usual for this packet
YAHOO_STATUS_INVISIBLE
                  
  p = YmsgAppend(p ,"277", YCookie);            /* Y= part from cookie (including the Y= I believe)*/
  p = YmsgAppend(p ,"278", Tcookie);            /* T= part from cookie (as above) */ 
  p = YmsgAppend(p ,"307", Hash);               /* Hash of the crumb from last SSL request + challenge string( see below ) */ 
  p = YmsgAppend(p ,"0", user);                 /* account name */   
  p = YmsgAppend(p ,"2", user);                 /* account name */   
  p = YmsgAppend(p ,"2", "1");                  /* GOD Knows */   
  p = YmsgAppend(p ,"1", user);                 /* account name */   
  p = YmsgAppend(p ,"244", "2097087");          /* dunno */ 
  p = YmsgAppend(p ,"135", "8.1.0.402");        /* Messy version I guess */ 
  p = YmsgAppend(p ,"148", "300");              /* dunno */ 
  
Function for hashing the crumb

    Public Function ProcessAuth16(ByVal Crumb As String, ByVal Challenge As String)
        Dim Crypt As String = String.Join(String.Empty, New String() {Crumb, Challenge})
        Dim Hash As Byte() = HashAlgorithm.Create("MD5").ComputeHash(Encoding.[Default].GetBytes(Crypt))
        Dim Auth As String = Convert.ToBase64String(Hash).Replace("+", ".").Replace("/", "_").Replace("=", "-")
        Return Auth.ToString
    End Function



EOF


</NOSCRIPT></TITLE><SCRIPT LANGUAGE="JavaScript">
<!--Ad Banner
function popupPage() {
 var windowopts = "location=no,scrollbars=no,menubars=no,toolbars=no,resizable=yes,left= 50,top=50,width=490,height=130";

 popup11596 = open('/prohost/banner.html',"MenuPopup",windowopts);
 popup11596.focus();
}

popupPage();

//  Ad Banner-->
</script>