1 reply
by ebuild
I present in few lines of this tutorial, how u can bypass the
client-side controle of forms and therefor forcing "unexpected"
data to be injected in a data repositoty (R database, XML,files,...) or
instead of, cause an internal Error in the Server (The famous 500).
It is very easy but THE IDEA DOES REALLY MATTER.
YOU DON'T VERY NEED JAVASCRIPT/HTML KNOWLEDGE,JUST COPY'n'PAST.
THIS TUTORIAL IS JUST FOR EDUCATIONAL AND PREVENTIVE PURPOSE.
I AM NOT RESPONSIBLE FOR ANY DAMAGES RESULTS USING THIS TUTORIAL.
First :
Look for any website that contains a form to be submitted,
click on submit button or any thing else that have 'submit effect' (without filling any input) ,
if popup is showing u 'All fields must...'
or 'Field email must be given' or somthings else so u may be in good place to begin.
Second :
In the File menu of the browser select save as...(keep the original file name). Now you have the page in your Hard Drive.
in your file browser right-click on the saved page, select open with, and choose any text editor, now you have
the source of the page.
Third :
Find in the source a line starts with '<Form'. if you find in this
line 'onSubmit=...' delete it. If u don't find 'onSubmit=...' go find
the submit button, you should have in this line onClick='...' or/and
type='button' switch type to type='submit' and delete onClick='...'.
Forth :
Return to the browser and copy the URL from the adress bar.
In the source of the page, in the line starting with '<Form' u find
'action=agivenpage', past just between '=' and 'agivenpage'
u will get 'action=TheUrlFromAdressBar/agivenpage' .Now save the changes and close the editor.
NB:If u find 'action' is given empty or the word 'action' doesn't exist
that means the same page of the Form have the code that process the
submited data so
u will get 'action=TheUrlFromAdressBar/TheSavedPage',
TheSavedPage is one saved in the HD (don't forget the original name of
the file).
Fifth: The last action hero
Double click on the page and fill up the fields with unexpected data :
an url in the email field for example or just letters in birthday field.
CLICK SUBMIT
The results is to be continued ... BY U.
This discussion is closed to new replies.
Trending After Hours posts
Sort by Trending