Re: manipulating query strings

From: Karsten Johansson (ksaj@penetrationtest.com)
Date: Tue Feb 24 2004 - 14:29:47 EST

('binary' encoding is not supported, stored as-is) In-Reply-To: <006201c3fa45$4f84da60$419dacce@u3q6v1>

>Is there a way to send values to hidden fields ,
>
>i.e Input tags with type=hidden attribute a value from the URL if the action
>attribute on the FORM is ACTION ?
>
>e.g:
>
><FORM form1 ACTION= '/search/search.asp' METHOD=post>
>
><Input type=hidden name=serverName value=www.abc.com>
><Input type=hidden name=serverName value=www.def.com>

The "hard" way: copy the html file (or a simplified version of it), and edit the type=

The "easy" way: Use SPIKE proxy. Not only can you then modify those hidden tags at will, you can edit anything transmitted to/from the web server. There's also automated DoS and SQL insertion attacks for all of the inputs.

    Karsten Johansson
    www.PENETRATIONTEST.com

---------------------------------------------------------------------------
----------------------------------------------------------------------------

This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:49 EDT