From: morning_wood (se_cur_ity@hotmail.com)
Date: Thu Feb 26 2004 - 02:10:43 EST
mabey graphically this clarifies things...
the below does work with a GET
---------- snip ----------
<form method="POST" action="http://www.geobytes.com/IpLocator.htm?GetLocation">
<input type="hidden" name="cid" value="0">
<input type="hidden" name="c" value="">
<input type="hidden" name="Template" value="iplocator.htm">
<h3>IP Address to locate:<input type="text" name="ipaddress" size="15"
value=""> <input type="submit" value="Submit">
---------- snip ---------------
you change the "POST" to a "GET", it does not load
http://www.geobytes.com/IpLocator.htm?GetLocation?cid=0&c=&Template=iplocator.ht
m&ipaddress=0.0.0.0
yet,
-------- snip ----------
<FORM METHOD="GET" ACTION="http://www.cracks.spb.ru"
ENCTYPE="application/x-www-form-urlencoded">
<INPUT TYPE="hidden" NAME="page" VALUE="0">
Search cracks:
<INPUT TYPE="text" NAME="ss" VALUE="" SIZE=15>
<INPUT TYPE="submit" NAME="Search" VALUE="Search">
<BR></FORM>
--------- snip ----------
the above does work with a GET
so you can have an accept / deny rule based on the "METHOD"
obviously cracks.spb.ru accepts any "METHOD" while geobytes.com
only accepts a "POST" METHOD. "hidden" tags are only client based
and the server script has no way to tell if it ( the info submitted )
was "hidden" or not.
hope this helps,
Donnie Werner
http://exploitlabs.com
>The hidden input fields don't differ from any other input field, except of
course that if your browser is given a HTML form with >fields, it doesn't show
the hidden fields. So the hidden fields can be modified just like any other
fields, and when your browser >sends a form to the web server, it simply lists
all fields with their values - it doesn't differentiate between hidden and
visible.
>
>Whether you can OVERRIDE the POSTed parameters by URL parameters, I'd say
generally no. I believe the default is, if the >web application gets a field
called "name" both as a POST data and as a URL parameter (script.asp?name=value)
then the >POSTed field overrides the URL field.
>
>So, 1) it all depends on the web application and 2) most likely with defaults,
you can't.
>
>If not, you can of course just take the HTML page with the form and save it to
your hard drive, and change the hidden fields to >something else with notepad,
or just delete them and pass the values in the URL.
>
>All and all, if you aren't trying to accomplish XSS then I'd say you should try
perl's LWP (lib-www-perl) module: it's a simple >library you can easily use to
post any parameters you want and send arbitrary User-Agent versions etc.,
whatever suits your >needs.
>
---------------------------------------------------------------------------
----------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:49 EDT