[web] [php] fake form post

The encrypted value probably holds some transaction details, combined with some salt values (look it up), precisely so no-one could forge the post info. This is called private key encryption, where the client has neither all the keys nor the algorithm that generates the security hash, but still needs to pass it back to the server for validation. If you're trying to legally use it, contact the PayPal developer relations staff for instructions.

yeah i have the encrypted data to send them i've just left it out here and replaced it with "some value here needs to be posted!".

Quote:

Original post by Nik02 The encrypted value probably holds some transaction details, combined with some salt values (look it up), precisely so no-one could forge the post info. This is called private key encryption, where the client has neither all the keys nor the algorithm that generates the security hash, but still needs to pass it back to the server for validation. If you're trying to legally use it, contact the PayPal developer relations staff for instructions.

Ok, nik02, starting from the top.

Its called public key crypography. Its an asymetric cypher, where the key to encrypt is different from the key to decrypt. (so people sending you stuff have your "public" key, so they can encrypt stuff going to you, but they cannot decrypt mail going to you, because they do not have your "private" or decryption key).

As per hashes and salts:
A salt is a set of random bytes prepended to a hash function, so as to stop replay attacks. (this also helps people using a rainbow table, ect. from reversing your hash).

For example, for a game logon system:

So grab a random two character string from the server (the salt), and prepend it onto your username+password combo. (already hashed, probably), before hashing it and sending it to the server.

as code: output_hash = md5(randomstring + md5(password + username));

When you send it to the server.

The server has a list of all the valid md5(password + username)'s

So you calculate the hash for each of the u/p combinations with the salt that you sent to that client.

This then stops unscrupulous users from sending the same login packet to the server, to impersonate somebody else.

uh.... i'm not sure if thats an answer to the op, but hopefully it would be at least somewhat usefull.

To make a POST within a page, you can use something like the CURL library.

You could have some &#106avascript automate the submission of a form with hidden fields. This is the most common way of achieving this.<br><br>Doing a server-server post is not suitable, necessary, or allowed for this integration method with Paypal. A human must see the contents of the page after the submit.<br><br>Mark