[german] FritzBox - Smart-Home - Steuern über http

[S.M.T]

Guten Tag,

ich würde gerne eine Smart-Home Steckdose von AVM (FritzBox) über eine url einschalten lassen.
Der Aufbau der url sollte so aussehen: fritz.box/webservices/homeautoswitch.lua?ain=123456789012&switchcmd=setswitchon&sid=0
Die "AIN" ist die Adresse des Schaltaktor´s und bleibt gleich.
Die "SID" ändert sich regelmäßig und dies ist mein Problem. (Sicherheitsmerkmal von AVM)
Wäre die "SID" statisch gewesen, hätte ich den Aktions-Typ URL in Browser öffnen nehmen können.
Mit den Informationen von AVM kann ich leider nix anfangen: https://avm.de/fileadmin/user_upload/Gl ... erface.pdf

Der folgende Beitrag scheint auch eine Rolle zu spielen: viewtopic.php?f=4&t=2561

Wer kann mir ein Beispiel eines Flow/Code zeigen?

Gruß Sebastian

[Desmanto]

I don't understand German well. But it seems the sid is required and can be obtained during first box setup. Can you check if the sid is in the fritzbox menu?

If it require some MD5 calculation, we can use script hash() to calculate it.

[S.M.T]

Good day,

here is the translated text of my first article. I'm sorry for my bad english.

I would like to turn on a smart home outlet of AVM (FritzBox) on a url.
The structure of the url should look like this: fritz.box/webservices/homeautoswitch.lua?ain=123456789012&switchcmd=setswitchon&sid=0
The "AIN" is the address of the switch actuator and remains the same.
The "SID" changes regularly and this is my problem. (Security Feature of AVM)
If the "SID" had been static, I could have taken the action type URL in Open Browser.
With the information from AVM I can unfortunately do nothing: https://avm.de/fileadmin/user_upload/Gl ... 3Nov18.pdf

The following article also seems to play a role: viewtopic.php?f=4&t=2561

Who can show me an example of a flow / code?

Greetings Sebastian

[Desmanto]

The calculation method of the SID is presented at the end of the pdf : http://avm.de/fileadmin/user_upload/Glo ... ion_ID.pdf
There are two version of the calculation, for 4.74 and 5.50 above. Which OS version do you use?

If you are using 5.50 above, you can try to use http request to http://fritz.box/login_sid.lua
It should return xml file, which you can check the result in {response}. Add debug condition dialog after the http request to check it.
We need the node "Challenge", to calculate the SID, combined with the username password.

Since I don't have FritzBox, I need to see the xml content to see how to parse the "Challenge" node. The rest of the calculation can be done using the document

[S.M.T]

Hello Desmanto,

The calculation method of the SID is presented at the end of the pdf : http://avm.de/fileadmin/user_upload/Glo ... ion_ID.pdf
There are two version of the calculation, for 4.74 and 5.50 above. Which OS version do you use?

I have the FritzBox 7490 with the OS version 7.12

If you are using 5.50 above, you can try to use http request to http://fritz.box/login_sid.lua
It should return xml file, which you can check the result in {response}. Add debug condition dialog after the http request to check it.
We need the node "Challenge", to calculate the SID, combined with the username password.

Since I don't have FritzBox, I need to see the xml content to see how to parse the "Challenge" node. The rest of the calculation can be done using the document

return xml file:

Code: Select all

This XML file does not appear to have any style information associated with it. The document tree is shown below.
<SessionInfo>
<SID>0000000000000000</SID>
<Challenge>fd1003f2</Challenge>
<BlockTime>0</BlockTime>
<Rights/>
</SessionInfo>

Greetings Sebastian

[Desmanto]

I miss your link for the document explaning the calculation in English.

Base on your result, you should first use action HTTP request to http://fritz.box/login_sid.lua,
This will give your response in xml, which has the challenge node. Use script after http request

Code: Select all

username = "test";
password = "test123";

challenge = findAll(response, "<Challenge>(.*)</Challenge>", true)[0][1];
chapass = challenge + "-" + hash(challenge + "-" + password, "UTF-16LE", "MD5");

url = "http://fritz.box/login_sid.lua?username={username}&response={chapass}"

This will combine the challenge code you got with the password, calculate the md5 and combined back to the challenge. Then create the url with the challenge response.
Change the username password to yours.

After this, use HTTP request again, with the url is {url}. This will result in valid SID you can use later. Use script to get the SID.

Code: Select all

sid = findAll(response, "<SID>(.*)</SID>", true)[0][1];

command = "http://fritz.box/webservices/homeautoswitch.lua?ain=123456789012&switchcmd=setswitchon&sid=";
commandurl = command + sid;

use the {commandurl} to set the device on.

You have to try this, and if you get error, use debug dialog to see the error.

[S.M.T]

I miss your link for the document explaning the calculation in English.

Sorry, unfortunately I have not found a link to the document in English.

Thank you so much.
Now I can turn my Smart Home socket to switch on and off.

The password did not work immediately. A user password does not work. It must be the main password.
Greetings Sebastian

--------------------------------------------------------------------------
Ich danke dir sehr.
Jetzt kann ich meine Smart Home-Steckdose ein- und ausschalten.

Das Passwort hat nicht sofort funktioniert. Ein Benutzerpasswort funktioniert nicht. Es muss das Hauptpasswort sein.
Gruß Sebastian

[Desmanto]

Your link in the first post is already in English and I missed that. I looked around, got the German version. Further googling redirect me back to your link
Nice to know that it is working.

BTW, please remove your image, it is leaking your username password in the element name.

[S.M.T]

BTW, please remove your image, it is leaking your username password in the element name.

It is not the real username and password, this is just for this image.

[Desmanto]

It is not the real username and password, this is just for this image.

Oh, then it is fine then. No problem with the image.