Penetration Testing mailing list archives

Re: manipulating query strings


From: Ariel Martinez <ariel () muiscas udea edu co>
Date: Wed, 25 Feb 2004 18:02:12 -0500 (COT)

On Tue, 24 Feb 2004, Eric Paynter wrote:

Vel said:
Given the Method is "POST", can I pass values to the Hidden Input
fields using the URL. i.e URL manipulation ?
I know I can pass variables in URL to Server side script variables
if METHOD is "GET".

[...]


More reliable way: save the HTML, edit it, and post it.

You can search a tool called Form Scalpel.  It can manipulate any field 
(hidden or not), with POST o GET.  Or simply use any proxy tool like 
Achilles or Paros.  

-- 
Ariel Martinez.


---------------------------------------------------------------------------
----------------------------------------------------------------------------


Current thread: