Log in to an EX90?

[DraxDomax]

We have both a DX70 and an EX90

I am able to write scripts that contain HTTPS calls to the DX70, by first creating a session and receiving a token ("/xmlapi/session/begin" => 'Set-Cookie': 'SecureSessionId=...; Path=/; secure; HttpOnly')
These work fine all the way through...

Now, I am using the same script but now, addressing our EX90. After posting to "/xmlapi/session/begin", I get [200] and "a cookie": 'Set-Cookie': "ClientId=b'...'; Path=/web; HttpOnly"

Trying to use that cookie in the same way I do for DX70 fails with 401-Unauthorized 
Do I need to parse the EX90 cookie somehow?

I know you "don't publish the EX90 API doc" and that there's apparently some XMLAPI vulnerability - still not sure how I can proceed.

My EX90 is: TC7.3.21.6ac6d47

[Wayne DeNardi]

The EX runs the old "TC7.x" software, where your "DX" is likely on CE9.x (or the intermediate CE8.x), so while your code may work on one, it's likely not to work on the other without modifications.

You can use the C90 guide as a general guideline as to what may work on the EX, as they're both "TC" based.  Obviously, there are some things that aren't going to be the same between the two models, but it should be enough to get you started.

codec-c90-api-reference-guide-tc73.pdf (cisco.com)

[DraxDomax]

Hello Wayne and thanks for taking a look.
The C90 manual is the one I used for figuring out how to connect to the DX70 in the first place... It's something I already have and still I am not satisfied. The C90 manual describes the XMLAPI login in the way it works for DX70 and doesn't work for EX90.

I need information specific to EX90. I already know a few things are not the same, obviously. 
Problem is, I can't brute-force all possible login strings I need to know how to log in to an EX90 (not just any TC device), please

Cheers