RE: manipulating query strings

• Previous message: Pedro Andujar: "Re: question regarding nessus plug-in 10595 DNS AXFR"
• Maybe in reply to: Vel: "manipulating query strings"
• Next in thread: marko: "Re: manipulating query strings"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Tue, 24 Feb 2004 13:34:53 -0500
To: "Vel" <vel@sympatico.ca>, <pen-test@securityfocus.com>

You can do this through JavaScript only. You WANT to say something like:

<script language="javascript">
  function bar() {
    var fooForm = document.getElementById('foo');
    fooForm.action = fooForm.serverName.value + fooForm.action;
  }
</script>

<form id="foo" action="/search.asp" method="post" onsubmit="javascript:bar();">
  <input type="hidden" name="serverName" value="www.server.com"/>
</form>

Just make sure you don't have another hidden form field named "action" in there,
or it will conflict, I believe.

You might also be able to work something in like:

<form action="javascript:expression(this.serverName.value)+'/search.asp')" ...

but I haven't tested that 2nd one.

Michael Scovetta

-----Original Message-----
From: Vel [mailto:vel@sympatico.ca]
Sent: Monday, February 23, 2004 2:43 PM
To: pen-test@securityfocus.com
Subject: manipulating query strings

Hello Group,

Is there a way to send values to hidden fields ,

i.e Input tags with type=hidden attribute a value from the URL if the action
attribute on the FORM is ACTION ?

e.g:

<FORM form1 ACTION= '/search/search.asp' METHOD=post>

<Input type=hidden name=serverName value=www.abc.com>
<Input type=hidden name=serverName value=www.def.com>

---------------------------------------------------------------------------

Given the Method is "POST", can I pass values to the Hidden Input fields
using the URL. i.e URL manipulation ?
I know I can pass variables in URL to Server side script variables if METHOD
is "GET".

But how about POST method ?

Thanks.

Kumar.

---------------------------------------------------------------------------
Free trial: Astaro Security Linux -- firewall with Spam/Virus Protection

Protect your network with the comprehensive security solution that
integrates six applications for ease of use and lower TCO.

Firewall - Virus protection - Spam protection - URL blocking - VPN
- Wireless security.

Download 30-day evaluation at:
http://www.securityfocus.com/sponsor/Astaro_pen-test_040219
----------------------------------------------------------------------------

---------------------------------------------------------------------------
----------------------------------------------------------------------------

• Previous message: Pedro Andujar: "Re: question regarding nessus plug-in 10595 DNS AXFR"
• Maybe in reply to: Vel: "manipulating query strings"
• Next in thread: marko: "Re: manipulating query strings"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]