Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

'-form-extraction' option: form data ignored (suggested fix) #1051

Closed
Grizzly2000 opened this issue Oct 9, 2024 · 0 comments · Fixed by #1052
Closed

'-form-extraction' option: form data ignored (suggested fix) #1051

Grizzly2000 opened this issue Oct 9, 2024 · 0 comments · Fixed by #1052
Assignees
Labels
Status: Completed Nothing further to be done with this issue. Awaiting to be closed. Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors.
Milestone

Comments

@Grizzly2000
Copy link

katana version:

   __        __                
  / /_____ _/ /____ ____  ___ _
 /  '_/ _  / __/ _  / _ \/ _  /
/_/\_\\_,_/\__/\_,_/_//_/\_,_/							 

		projectdiscovery.io

[INF] Current version: v1.1.0

Current Behavior:

Using '-form-extraction' option, the extraction of form data is ignored when the action field of the "form" tag is set to "#".

Expected Behavior:

To fix the issue, simply replace the value "#" with an empty string ("") in extracted action field.

Suggested Fix:
To fix the problem, add the following code at line 27 of the file pkg/utils/formfields.go:

if action == "#" {
    action = ""
}

Go to File : https://github.com/projectdiscovery/katana/blob/main/pkg/utils/formfields.go#L27

Steps To Reproduce:

./katana -u https://pentest-ground.com:4280/vulnerabilities/sqli/ -fx -j  -or -ob -crawl-scope https://pentest-ground.com:4280/vulnerabilities/sqli/| jq '.response.forms | select( . != null )'

With the patch

   __        __                
  / /_____ _/ /____ ____  ___ _
 /  '_/ _  / __/ _  / _ \/ _  /
/_/\_\\_,_/\__/\_,_/_//_/\_,_/							 

		projectdiscovery.io

[INF] Current katana version v1.1.0 (latest)
[INF] Started standard crawling for => https://pentest-ground.com:4280/vulnerabilities/sqli/
[
  {
    "method": "GET",
    "action": "https://pentest-ground.com:4280/vulnerabilities/sqli/",
    "parameters": [
      "id",
      "Submit"
    ]
  }
]

Without the patch

   __        __                
  / /_____ _/ /____ ____  ___ _
 /  '_/ _  / __/ _  / _ \/ _  /
/_/\_\\_,_/\__/\_,_/_//_/\_,_/							 

		projectdiscovery.io

[INF] Current katana version v1.1.0 (latest)
[INF] Started standard crawling for => https://pentest-ground.com:4280/vulnerabilities/sqli/

Thanks ! :)

@Grizzly2000 Grizzly2000 added the Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors. label Oct 9, 2024
@dogancanbakir dogancanbakir self-assigned this Oct 9, 2024
@dogancanbakir dogancanbakir linked a pull request Oct 11, 2024 that will close this issue
@ehsandeep ehsandeep added the Status: Completed Nothing further to be done with this issue. Awaiting to be closed. label Oct 28, 2024
@dogancanbakir dogancanbakir added this to the katana v1.1.1 milestone Oct 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Status: Completed Nothing further to be done with this issue. Awaiting to be closed. Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants