Re: manipulating query strings

From: Markus Toman (m.toman@sec-consult.com)
Date: Wed Feb 25 2004 - 09:57:03 EST

Hi

The HTTP header sent by the browser contains the POST-Variables.
There are many ways to change the value in hidden fields.

i.e.:
- Save the Page, change the source, change form action from
'/search/search.asp' to 'http://>/search/search.asp' and the
hidden field values to what ever you like.

- Write a prog or use telnet and send the HTTP header yourself

- Try Firefox with the Live HTTP headers plugin. you can capture
outgoing http requests, modify them and send again..
http://www.mozilla.org/products/firefox/
http://texturizer.net/firefox/extensions/#livehttpheaders

Vel wrote:

>Hello Group,
>
>Is there a way to send values to hidden fields ,
>
>i.e Input tags with type=hidden attribute a value from the URL if the action
>attribute on the FORM is ACTION ?
>
>e.g:
>
><FORM form1 ACTION= '/search/search.asp' METHOD=post>
>
><Input type=hidden name=serverName value=www.abc.com>
><Input type=hidden name=serverName value=www.def.com>
>
>
>---------------------------------------------------------------------------
>
>Given the Method is "POST", can I pass values to the Hidden Input fields
>using the URL. i.e URL manipulation ?
>I know I can pass variables in URL to Server side script variables if METHOD
>is "GET".
>
>But how about POST method ?
>
>Thanks.
>
>Kumar.
>
>
>---------------------------------------------------------------------------
>Free trial: Astaro Security Linux -- firewall with Spam/Virus Protection
>
>Protect your network with the comprehensive security solution that
>integrates six applications for ease of use and lower TCO.
>
>Firewall - Virus protection - Spam protection - URL blocking - VPN
>- Wireless security.
>
>Download 30-day evaluation at:
>http://www.securityfocus.com/sponsor/Astaro_pen-test_040219
>----------------------------------------------------------------------------
>
>
>
>

---------------------------------------------------------------------------
----------------------------------------------------------------------------

This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:49 EDT