1

The following is an excerpt of a PHP script within a HTML file. I would like to be able to alter the variable when I am being served the HTML file. Is there anyway to do so? Most vulnerabilities i found online are exploits for $_GET.

if (isset ($_POST['variable']))
{$temp = $_POST['variable'];
if (strlen($temp) == 20)
{
 ....
} else echo "Failed";
...
}
Improve this question

2 Answers 2

Reset to default
1

Have a look at curl, or a similar library:

curl -d foo=bar http://example.org

will send the request as a POST, with the variable foo set to value bar.

HTTP is a clear text protocol, fairly human readable. If you use a decent browser, like chrome, you can open the web developer console and watch all requests, including payload. In chrome you press F12 to open the developer console.

If you're interested in HTTP, read the relevant standards. Wikipedia is a good starting point.

Improve this answer
8
  • Just writing some html or using a browser plugin like tamperdata would also suffice (a lot of people don't have a well equipped posix system to hand)
    – symcbean
    Sep 14, 2017 at 18:46
  • @symcbean turns out tamperdata isn't supported on newer versions of firefox, unless you have a workaround? ;)
    – seelani
    Sep 14, 2017 at 18:54
  • My point was that there are lots of ways to do something as simple as setting the value of a post variable.
    – symcbean
    Sep 14, 2017 at 18:56
  • curl works equally well on windows. So does chrome. And if you're interested in security, not having a Linux system is gross negligence...
    – vidarlo
    Sep 14, 2017 at 18:56
  • @vidarlo thanks for your help, it does work and i can enter the if loop. i've encountered another problem where the POST value does not stick if that's the correct way to put it. the first line in the loop i attempt to store the POST value in a variable. $temp=$_POST['variable']; this is not recognised.
    – seelani
    Sep 14, 2017 at 18:57
2

$_POST is just as vulnerable as $_GET. If this variable is not being sanitised and/or validated later in this script then you can manipulate it however you like.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .