figured out token works, next up firstnouse

routerapi.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+
+token=$(curl -c .cookie $ROUTER_ADDRESS/api/webserver/token -s | xmlstarlet sel -t -v "/response/token")
+echo $token
+token_start=$(echo "${token::${#token}-32}")
+token_end=$(echo ${token:32})
+
+echo $token_start$token_end
+echo $token_start
+echo $token_end
+
+
+curl -s -b .cookie "$ROUTER_ADDRESS/api/user/challenge_login" \
+  -H "Origin: $ROUTER_ADDRESS" \
+  -H "Referer: $ROUTER_ADDRESS/html/home.html" \
+  -H "_ResponseSource: Broswer" \
+  -H "__RequestVerificationToken: $token_end" \
+  --data-raw "<?xml version="1.0" encoding="UTF-8"?><request><username>admin</username><firstnonce>58eb18b0cf49b69cb2b5b6204d32394a464ca082c0cb5a80b51811883cf4f076</firstnonce><mode>1</mode></request>" \