What do you mean by saying this?

you mean it look in the source code to find the difference ?

and what do it use headless browser or just curl commands ?

like in HG531s V1

there are two changing values

192.18.1.1/index/login.cgi?Username=admin&Password=4dd5396782e8bbe6 4f8a4d6ac770fc505446dc7171709d43be4c73ee524c6996&c hallange=0x5vOa1XyydFn2gHAUYo

the password changes every time i enter it and that challange too it gets it from 192.168.1.1/html/ajaxref/updatachallangeajax.asp

although when i tried to grab it myself still the login failed and that value changes every time you try to fetch that page !

btw do you know how can i grab the login command correctly cause it goes so fast in google chrome network tab that i can't catch it and wireshark doesn't gave me the full thing together but at parts !

thanks i hope you understand me

and i hope you are having a good day