Where's the cheese?
--#--
Now it's time to examine the source some more. Could the missing
data be hidden in the cookie? It might be, but it's not. You can
try sending the cookie (add a Cookie: line to the header
you send and paste in the cookie string sent by BK. Won't do
much good, though. The cookie is probably just a session ID, so
Burger King can count the number of unique visitors to
its site.
What about those hidden fields just under the <form> tag?
Another funky twist to the HTTP POST: Check out the JavaScript
in the HTML header.
If you study it, you'll see that it's mapping the value of the
<SELECT NAME=so> field to a field of si
and the value of the <SELECT NAME=sc> field to a field of
ac.
If you want, try to figure out how this works by performing the JavaScript
translations on paper, and using the hidden fields. I tried myself for
quite a bit of time, before I hit on a trick solution using yet another
Java gadget.