Methods

  • Article

Decoded Method

Use a packet capturing program such as Network Monitor, which allows examining network traffic to and from the server at the packet level,  to capture packets between the server extensions and a client. Note that depending on the program you use and the operating system, you can filter packets either as HTTP or TCP packets. If you use TCP as the filter, you will need to inspect each TCP packet for the HTTP POST command. For instance, on UNIX systems, the HTTP protocol is always embedded in the TCP packet.

The first packet you capture is usually the HTTP POST. It is followed by a Keep-Alive packet. The last packet or set of packets to cross the wire contain the return code for the method. The return code is always in the form of an HTML page or in some cases pages. Most return codes include meta-keys that carry information about the data transmitted over the wire. 

Each POST request sent by a client using SharePoint Team Services from Microsoft or Microsoft FrontPage Server Extensions includes a string that specifies the RPC method to execute and any parameters required for the method. For example, here is a sample FrontPage Server Extensions post:

POST./allnew/_vti_bin/_vti_aut/author.dll 
HTTP/1.0CRLF
Date: Thu, 03 Dec 1998 19:09:16 GMTCRLF
MIME-Version: 1.0CRLF
User-Agent: MSFrontPage/4.0CRLF
Host: server_nameCRLF
Accept: auth/sicilyCRLF
Authorization: Basic cm9iZjpUS3NvKjUwCRLF
Content-Length: 343CRLF
Content-Type: application/x-www-form-urlencodedCRLF
X-Vermeer-Content-Type: application/x-www-form-urlencodedCRLF
method=list+documents%3a4%2e0%2e1%2e2207&service%5
fname=%2fallnew&listHiddenDocs=false&listExplorerDocs=false&listRecurse=false&listFiles=true&listFolders=true
&listLinkInfo=true&listIncludeParent=true&listDerived=false&listBorders=false&listChildWebs=true
&initialUrl=&platform=WinI386&folderList=%5b%3bTW%7c09+Nov+1998+17%3a03%3a25+%2d0000%5d.LF

The POST above is in the format sent by the client. When you capture a POST using a program such as Network Monitor, it will look like this:

POST./allnew/_vti_bin/_vti_aut/author.dll.HTTP/1.0..Date:.Tue,.19.Jan.1999.19:58:GMT.. 
MIME-Version:.1.0..User-Agent:.MSFrontPage/4.0..Host:.v-rfrank3.. 
Accept:.auth/sicily..Authorization:.Basic.di1yZnJhbms6VEtzbzUwKg==.. 
Content-Length:.317..Content-Type:.application/x-www-form-urlencode.. 
X-Vermeer-Content-Type:.application/x-www-form-urlencoded.... 
method=list+documents%3a4%2e0%2e1%2e2276&service%5fname=&listHiddenDocs=false 
&listExplorerDocs=false&listRecurse=false&listFiles=true&listFolders=true 
&listLinkInfo=true&listIncludeParent=true&listDerived=false&listBorders=false 
&listChildWebs=true&initialUrl=&folderList=%5b%3bTW%7c13+Jan+1999+16%3a16%3a17+%2d0000%5d.

The example above is a stream of data that is initially embedded in other code, like this:

00000030 50 4F 53 54 20 2F 70 72 6F 64 
POST./allnew/ 00000040 39 38 2F 5F 76 74 69 5F 62 69 6E 2F 5F 76 74 69 
98/_vti_bin/_vti 00000050 5F 61 75 74 2F 61 75 74 68 6F 72 2E 64 6C 6C 20 
_aut/author.dll. 00000060 48 54 54 50 2F 31 2E 30 0D 0A 44 61 74 65 3A 20 
HTTP/1.0..Date:. 00000070 54 75 65 2C 20 31 39 20 4A 61 6E 20 31 39 39 39 
Tue,.19.Jan.1999 00000080 20 32 30 3A 33 35 3A 32 36 20 47 4D 54 0D 0A 4D 
.19:58:GMT..M

To make this code more readable, several edits are made. First code at the start of each line is stripped away to reveal the POST command. Then all the remaining line breaks are removed to form a stream of data. Line breaks are added back in to aid the readability. Note that the periods (.) in this stream are really all control characters and spaces. They too are removed.

Below is the method from the example above. Note that, even by itself, it is hard to understand in this form.

method=list+documents%3a4%2e0%2e1%2e2207&service%5fname=%2fallnew&listHiddenDocs=false 
&listExplorerDocs=false&listRecurse=false&listFiles=true&listFolders=true 
&listLinkInfo=true&listIncludeParent=true&listDerived=false&listBorders=false 
&listChildWebs=true &initialUrl=&platform=WinI386 
&folderList=%5b%3bTW%7c09+Nov+1998+17%3a03%3a25+%2d0000%5d.

The Decoded section of each methods page presents the method with the POST command.  In the example below, the method was directed to the author.dll server extension program as you can see from the end of the POST command.

POST./allnew/_vti_bin/_vti_aut/author.dll 
HTTP/1.0CRLF
.
.
.
method=list+documents:4.0.1.2207 &service_name=/allnew 
&listHiddenDocs=false &listExplorerDocs=false 
&listRecurse=false &listFiles=true 
&listFolders=true &listLinkInfo=true 
&listIncludeParent=true 
&listDerived=false &listBorders=false 
&listChildWebs=true &initialUrl= 
&platform=WinI386 &folderList=[;TW|09+Nov+1998+17:03:25+-0000]

The missing HTTP header lines are represented by the ellipses (...). The method and its parameters' values follow in an easy to read format. For more information about the format in which to send a POST command, see Form of a POST Command.