You are sending the data in the query string--is that what you want, or
should it be the post data portion? If so, this should be the line:<br>
<br>
<p class="MsoNormal">"400004","0","4","/mysearch/mySearchResults.jsp","POST","alert(4567890)","","","","","Form Submission XSS vulnerability exists","_ARGS=/</p>
<p class="MsoNormal">mysearch/gadgets/mySearch.jsp.searchform _dyncharset=ISO-8859-1&_dynSessConf=-6740532443327654779&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchString=%3E%5C%22%3E%3Cscript%3Ealert%284567890%29%3C%2Fscript%3E%3C&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchString=+&questionSaved=http%3A%2F%2F127.0.0.1%2Fmysearch%2FmySearchResults.jsp%3F_ARGS%3D%2Fmysearch%2Fgadgets%2FmySearch.jsp.searchform&catIdSaved=&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.goToPage=1&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.goToPage=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.docSort=relevance&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.docSort=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.docSortOrder=descending&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.docSortOrder=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.multiSearchSession=true&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.multiSearchSession=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.saveRequest=true&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.saveRequest=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.pageSize=12&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.pageSize=+&searchExecByFormSubmit=true&_ARGS=%2Fmysearch%2Fgadgets%2FmySearch.jsp.searchform",""</p>
<br><br><div class="gmail_quote">On Fri, Dec 3, 2010 at 12:14 PM, Andre, Lionel <span dir="ltr"><<a href="mailto:landre@atg.com">landre@atg.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div link="blue" vlink="purple" lang="EN-US"><div><p class="MsoNormal"> </p><p class="MsoNormal">I have a weird issue with testing the submission of a form using POST. </p><p class="MsoNormal"> </p><p class="MsoNormal">
Using live HTTP headers extension in FF I grabbed the whole form submission. Using the replay function in FF it works fine, however using nikto in debug mode I get the following info. (sanitized a few things) </p>
<p class="MsoNormal"> </p><p class="MsoNormal">Any ideas are welcome. The form itself has a lot of hidden fields in it and I am trying to figure out which ones are absolutely required. </p><p class="MsoNormal"> </p><p class="MsoNormal">
Thanks! </p><p class="MsoNormal">The contents of the udb_test line: </p><p class="MsoNormal"> </p><p class="MsoNormal">"400004","0","4","/mysearch/mySearchResults.jsp?_ARGS=/mysearch/gadgets/mySearch.jsp.searchform _dyncharset=ISO-8859-1&_dynSessConf=-6740532443327654779&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchString=%3E%5C%22%3E%3Cscript%3Ealert%284567890%29%3C%2Fscript%3E%3C&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchString=+&questionSaved=http%3A%2F%2F127.0.0.1%2Fmysearch%2FmySearchResults.jsp%3F_ARGS%3D%2Fmysearch%2Fgadgets%2FmySearch.jsp.searchform&catIdSaved=&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.goToPage=1&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.goToPage=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.docSort=relevance&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.docSort=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.docSortOrder=descending&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.docSortOrder=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.multiSearchSession=true&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.multiSearchSession=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.saveRequest=true&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.saveRequest=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.pageSize=12&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.pageSize=+&searchExecByFormSubmit=true&_ARGS=%2Fmysearch%2Fgadgets%2FmySearch.jsp.searchform","POST","alert(4567890)","","","","","Form Submission XSS vulnerability exists","",""</p>
<p class="MsoNormal"> </p><p class="MsoNormal"> </p><p class="MsoNormal">THE REQUEST: </p><p class="MsoNormal"> </p><p class="MsoNormal">D:Thu Dec 2 14:48:29 2010 'Request Hash' = {</p><p class="MsoNormal"> 'whisker' => {</p>
<p class="MsoNormal"> 'protocol' => 'HTTP',</p><p class="MsoNormal"> 'require_newline_after_headers' => 0,</p><p class="MsoNormal">
'lowercase_incoming_headers' => 1,</p><p class="MsoNormal"> 'uri_prefix' => '',</p><p class="MsoNormal"> 'ssl_save_info' => 1,</p>
<p class="MsoNormal"> 'http_space2' => ' ',</p><p class="MsoNormal"> 'uri_param_sep' => '?',</p><p class="MsoNormal"> 'timeout' => 10,</p>
<p class="MsoNormal"> 'http_space1' => ' ',</p><p class="MsoNormal"> 'method' => 'POST',</p><p class="MsoNormal"> 'force_open' => 0,</p>
<p class="MsoNormal"> 'include_host_in_uri' => 0,</p><p class="MsoNormal"> 'ignore_duplicate_headers' => 1,</p><p class="MsoNormal"> 'uri_postfix' => '',</p>
<p class="MsoNormal"> 'keep-alive' => 1,</p><p class="MsoNormal"> <span lang="FR">'ssl' => 0,</span></p><p class="MsoNormal"><span lang="FR"> 'version' => '1.1',</span></p>
<p class="MsoNormal"><span lang="FR"> 'data' => '',</span></p><p class="MsoNormal"><span lang="FR"> 'port' => 80,</span></p><p class="MsoNormal">
<span lang="FR"> </span>'uri' => '/mysearch/mySearchResults.jsp?_ARGS=/mysearch/gadgets/mySearch.jsp.searchform _dyncharset=ISO-8859-1&_dynSessConf=-6740532443327654779&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchString=%3E%5C%22%3E%3Cscript%3Ealert%284567890%29%3C%2Fscript%3E%3C&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchString=+&questionSaved=http%3A%2F%2F127.0.0.1%2Fmysearch%2FmySearchResults.jsp%3F_ARGS%3D%2Fmysearch%2Fgadgets%2FmySearch.jsp.searchform&catIdSaved=&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.goToPage=1&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.goToPage=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.docSort=relevance&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.docSort=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.docSortOrder=descending&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.docSortOrder=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.multiSearchSession=true&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.multiSearchSession=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.saveRequest=true&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.saveRequest=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.pageSize=12&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.pageSize=+&searchExecByFormSubmit=true&_ARGS=%2Fmysearch%2Fgadgets%2FmySearch.jsp.searchform',</p>
<p class="MsoNormal"> 'host' => '127.0.0.1',</p><p class="MsoNormal"> 'retry' => 0,</p><p class="MsoNormal"> 'normalize_incoming_headers' => 1,</p>
<p class="MsoNormal"> 'invalid_protocol_return_value' => 1,</p><p class="MsoNormal"> 'force_bodysnatch' => 0,</p><p class="MsoNormal"> 'MAGIC' => 31339,</p>
<p class="MsoNormal"> 'max_size' => 0,</p><p class="MsoNormal"> 'trailing_slurp' => 0,</p><p class="MsoNormal"> 'force_close' => 0,</p>
<p class="MsoNormal"> 'http_eol' => "\r\n"</p><p class="MsoNormal"> },</p><p class="MsoNormal"> 'User-Agent' => 'Mozilla/4.75 (Nikto/2.1.3) (Evasions:None) (Test:400004)',</p>
<p class="MsoNormal"> 'Connection' => 'Keep-Alive',</p><p class="MsoNormal"> 'Content-Length' => 0,</p><p class="MsoNormal"> <span lang="FR">'Content-Type' => 'application/x-www-form-urlencoded',</span></p>
<p class="MsoNormal"><span lang="FR"> </span>'Host' => '127.0.0.1'</p><p class="MsoNormal">};</p><p class="MsoNormal"> </p><p class="MsoNormal"> </p><p class="MsoNormal"> </p><p class="MsoNormal">
RESPONSE: </p><p class="MsoNormal"> </p><p class="MsoNormal"> </p><p class="MsoNormal"> </p><p class="MsoNormal">D:Thu Dec 2 14:48:29 2010 'Result Hash' = {</p><p class="MsoNormal"> 'connection' => 'close',</p>
<p class="MsoNormal"> 'whisker' => {</p><p class="MsoNormal"> 'protocol' => 'HTTP',</p><p class="MsoNormal"> 'lowercase_incoming_headers' => 1,</p>
<p class="MsoNormal"> 'http_space2' => ' ',</p><p class="MsoNormal"> <span lang="FR">'stats_reqs' => 21,</span></p><p class="MsoNormal">
<span lang="FR"> 'http_space1' => ' ',</span></p><p class="MsoNormal"><span lang="FR"> 'code' => 400,</span></p><p class="MsoNormal">
<span lang="FR"> 'stats_syns' => 6,</span></p><p class="MsoNormal"><span lang="FR"> 'version' => '1.1',</span></p><p class="MsoNormal">
<span lang="FR"> </span>'abnormal_header_spacing' => 1,</p><p class="MsoNormal"> 'data' => '<html><body><b>Http/1.1 Bad Request</b></body> </html>',</p>
<p class="MsoNormal"> 'uri' => '/mysearch/mySearchResults.jsp?_ARGS=/mysearch/gadgets/mySearch.jsp.searchform _dyncharset=ISO-8859-1&_dynSessConf=-6740532443327654779&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchString=%3E%5C%22%3E%3Cscript%3Ealert%284567890%29%3C%2Fscript%3E%3C&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchString=+&questionSaved=http%3A%2F%2F127.0.0.1%2Fmysearch%2FmySearchResults.jsp%3F_ARGS%3D%2Fmysearch%2Fgadgets%2FmySearch.jsp.searchform&catIdSaved=&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.goToPage=1&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.goToPage=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.docSort=relevance&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.docSort=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.docSortOrder=descending&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.docSortOrder=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.multiSearchSession=true&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.multiSearchSession=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.saveRequest=true&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.saveRequest=+&%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.pageSize=12&_D%3A%2Fmy%2Fsearch%2Fformhandlers%2FQueryFormHandler.searchRequest.pageSize=+&searchExecByFormSubmit=true&_ARGS=%2Fmysearch%2Fgadgets%2FmySearch.jsp.searchform',</p>
<p class="MsoNormal"> 'message' => 'Bad Request',</p><p class="MsoNormal"> 'header_order' => [</p><p class="MsoNormal"> 'content-length',</p>
<p class="MsoNormal"> 'connection'</p><p class="MsoNormal"> ],</p><p class="MsoNormal"> 'http_data_sent' => 1,</p>
<p class="MsoNormal"> 'MAGIC' => 31340,</p><p class="MsoNormal"> 'http_eol' => "\r\n",</p><p class="MsoNormal"> 'socket_state' => 0</p>
<p class="MsoNormal"> },</p><p class="MsoNormal"> 'content-length' => 54</p><p class="MsoNormal">};</p><p class="MsoNormal"> </p><p class="MsoNormal"> </p><p class="MsoNormal"> </p>
</div></div><br>_______________________________________________<br>
Nikto-discuss mailing list<br>
<a href="mailto:Nikto-discuss@attrition.org">Nikto-discuss@attrition.org</a><br>
<a href="https://attrition.org/mailman/listinfo/nikto-discuss" target="_blank">https://attrition.org/mailman/listinfo/nikto-discuss</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br><br><a href="http://www.cirt.net">http://www.cirt.net</a> | <a href="http://www.osvdb.org/">http://www.osvdb.org/</a><br>