Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

'-form-extraction' option: form data ignored (suggested fix) #1051

Open
Grizzly2000 opened this issue Oct 9, 2024 · 0 comments · May be fixed by #1052
Open

'-form-extraction' option: form data ignored (suggested fix) #1051

Grizzly2000 opened this issue Oct 9, 2024 · 0 comments · May be fixed by #1052
Assignees
Labels
Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors.

Comments

@Grizzly2000
Copy link

katana version:

   __        __                
  / /_____ _/ /____ ____  ___ _
 /  '_/ _  / __/ _  / _ \/ _  /
/_/\_\\_,_/\__/\_,_/_//_/\_,_/							 

		projectdiscovery.io

[INF] Current version: v1.1.0

Current Behavior:

Using '-form-extraction' option, the extraction of form data is ignored when the action field of the "form" tag is set to "#".

Expected Behavior:

To fix the issue, simply replace the value "#" with an empty string ("") in extracted action field.

Suggested Fix:
To fix the problem, add the following code at line 27 of the file pkg/utils/formfields.go:

if action == "#" {
    action = ""
}

Go to File : https://github.com/projectdiscovery/katana/blob/main/pkg/utils/formfields.go#L27

Steps To Reproduce:

./katana -u https://pentest-ground.com:4280/vulnerabilities/sqli/ -fx -j  -or -ob -crawl-scope https://pentest-ground.com:4280/vulnerabilities/sqli/| jq '.response.forms | select( . != null )'

With the patch

   __        __                
  / /_____ _/ /____ ____  ___ _
 /  '_/ _  / __/ _  / _ \/ _  /
/_/\_\\_,_/\__/\_,_/_//_/\_,_/							 

		projectdiscovery.io

[INF] Current katana version v1.1.0 (latest)
[INF] Started standard crawling for => https://pentest-ground.com:4280/vulnerabilities/sqli/
[
  {
    "method": "GET",
    "action": "https://pentest-ground.com:4280/vulnerabilities/sqli/",
    "parameters": [
      "id",
      "Submit"
    ]
  }
]

Without the patch

   __        __                
  / /_____ _/ /____ ____  ___ _
 /  '_/ _  / __/ _  / _ \/ _  /
/_/\_\\_,_/\__/\_,_/_//_/\_,_/							 

		projectdiscovery.io

[INF] Current katana version v1.1.0 (latest)
[INF] Started standard crawling for => https://pentest-ground.com:4280/vulnerabilities/sqli/

Thanks ! :)

@Grizzly2000 Grizzly2000 added the Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors. label Oct 9, 2024
@dogancanbakir dogancanbakir self-assigned this Oct 9, 2024
@dogancanbakir dogancanbakir linked a pull request Oct 11, 2024 that will close this issue
@dogancanbakir dogancanbakir linked a pull request Oct 11, 2024 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants