Re: [SL] capturing cgi requests

Fri, 09 Aug 2002 14:38:24 -0700

OK. I think I understand.
You can use this to parse the input.
#####################################################################
#
# Parse input
#
#####################################################################
sub ReadParse {
 local (*in) = @_ if @_;  local ($i, $loc, $key, $val);
 if ($ENV{'REQUEST_METHOD'} eq "GET") { $in = $ENV{'QUERY_STRING'};} 
 elsif ($ENV{'REQUEST_METHOD'} eq "POST")
      {read(STDIN,$in,$ENV{'CONTENT_LENGTH'});}
 @in = split(/&/,$in);
 foreach $i (0 .. $#in) {
  $in[$i] =~ s/\+/ /g;    ($key, $val) = split(/=/,$in[$i],2);
  $key =~ s/%(..)/pack("c",hex($1))/ge;
  $val =~ s/%(..)/pack("c",hex($1))/ge;
  $in{$key} .= "\0" if (defined($in{$key})); 
  $in{$key} .= $val;  
  }  
 return 1; 
 }
You can use this to put it into variables.

&ReadParse;

# Protect against "OPEN" vulnerability
# ------------------------------------
$in{config} =~ s|[^\s\w\.\/]||g;
$in{template} =~ s|[^\s\w\.\/]||g;

&read_config;

print $in{'login'};
print $in{'password'};
print $in{'action'};

I'm sure you get the idea.

If this doesn't help, I really don't understand. Perhaps you could rephrase the request.

Noel



Kabai J wrote:
Anyway you can see in the web page source what arguments are to be passed on by the post method. There is no need debugging it. In the logging screen you can see
<input class=login name=login>
<input class=login type=password name=password>
<input type=submit name=action value="Login">
<input type=hidden name=path value=bin/mozilla>
so you can call it from the command line this way:
login.pl "login=demo&password=demo&action=Login&path=bin/mozilla"
 
 
Joe
 
----- Original Message -----
Sent: Friday, August 09, 2002 5:50 PM
Subject: Re: [SL] capturing cgi requests

Oops. I forgot CPAN. That is a great place for perl modules, programs, examples, tutorials, etc.
http://www.cpan.org
Noel

Chris Beggy wrote:
On 9 Aug 2002, "Kabai J" <[EMAIL PROTECTED]> wrote:

  
Hi, you can debug the perl scripts with -d switch, for example :

perl -d login.pl "login=demo&password=demo&action=login&path=bin/mozilla"
    

Thanks.  My goal is to capture the arguments passed to the cgi
script by the http POST command.  Then, I will use that to create
shell scripts of command line calls.

Chris


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
-------------------------------------------------------
(un)subscribe: http://lists.sourceforge.net/lists/listinfo/sql-ledger-users
Archive: http://www.mail-archive.com/[email protected]/


Reply via email to