Penetration Testing: Re: manipulating query strings

[Ariel Martinez <ariel () muiscas udea edu co>]

On Tue, 24 Feb 2004, Eric Paynter wrote:

> Vel said:
> > Given the Method is "POST", can I pass values to the Hidden Input
> > fields using the URL. i.e URL manipulation ?
> > I know I can pass variables in URL to Server side script variables
> > if METHOD is "GET".
[...]

> More reliable way: save the HTML, edit it, and post it.
You can search a tool called Form Scalpel.  It can manipulate any field 
(hidden or not), with POST o GET.  Or simply use any proxy tool like 
Achilles or Paros.  

-- 
Ariel Martinez.


---------------------------------------------------------------------------
----------------------------------------------------------------------------