Replicating remote site "attack" by force sending specific form data to a page - asp-classic

I have this simple form:
<form method="post" id="theForm" action="user-password.asp">
<input type="hidden" name="what" value="process" />
<fieldset>
<div>
<label for="email">Username or Email</label>
<input type="text" class="form-control" id="email" name="email" placeholder="Username or Email" />
</div>
<div>
<button type="submit" class="btn btn-success top10">Submit</button>
</div>
</fieldset>
</form>
I have a script which emails me when my Classic ASP pages error - I use this to get all of the form contents:
For ix = 1 to Request.Form.Count
fieldName = Request.Form.Key(ix)
fieldValue = Request.Form.Item(ix)
bb = bb & fieldName & ": " & fieldValue & vbcrlf
Next
bb = newstr(bb)
For the above page, the page errored with:
A trappable error (C0000005) occurred in an external object. The script cannot continue running.
The form contents were like this:
form: email[$acunetix]: 1
what: process
In order to improve the error handling on the page, I'd like to be able to replicate loading the form with whatever it was that was used to generate the form input which made the page error - in the above example the form field name is not email but is email[$acunetix], which seems to have broken the page when it tries to process the form.
However, I don't know what was done to do that. The same IP address spent about 40 minutes forcing all kinds of stuff onto my pages which eventually crashed my site requiring a server reboot.
I realise that is down to me not writing robust enough code - but - I wondered how I can replicate sending the form data shown above to the page, as I'm stuck trying to work out how to do that.

Related

email pattern validation without form tag in angular

How to email validation in angular 13 version. I have used a input field and submit button. If email validation failed then alert show.
<input type="email" [pattern]="emailPattern"
class="form-control adduser" placeholder="Email address"
[(ngModel)]="newEmailId">
<button type="button" class="commonnew-btn" (click)="addNewUser()">Add User</button>
Please find the ts file code
emailPattern = "^[a-z0-9._%+-]+#[a-z0-9.-]+\.[a-z]{2,4}$";
addNewUser(){
}
How to write in this method. Please give me advice. Not using form group or form tag and reactive form. Only this condition.

Ljava.lang.String is displayed when I accesed param in thymeleaf Spring

I have a problem while accessing the page parameter in thymeleaf.
Please see my below code :
<input type="hidden" name="resetKey" th:value="${param.key}"/>
I am trying to access parameter key from query string and send it as hidden parameter to the server.
After page loads, it is displayed like below :
<input type="hidden" name="key" value="[Ljava.lang.String;#b1fd0f9">
I want to send the key back to the server when the form is submitted.
You are trying to print a multi-value, a String array. To print the first value:
<input type="hidden" name="resetKey" th:value="${param.key[0]}"/>
Or this should work too:
<input type="hidden" name="resetKey" th:value="${#request.getParameter('key')}"/>
Source: Spring MVC and Thymeleaf: how to access data from templates

MVC - Receive Form with Viewbag Variable from database and passing to the view

i have a html form into my database.
In this form i have a value which contains a Viewbag,
for example value="#Viewbag.MyVariable"
In my view when i try to receive my form all works fine,
but my problem is that the Viewbag value are not converting
to the value which comes from my controller.
any ideia how to resolve this ?
my code:
View:
#Html.Raw(p.Form)
My form in my database looks like:
<form action="/MyController/MyAction" method="post">
<input type="hidden" name="num" value="#ViewBag.num" />
....
....
....
</form>
What i have try to do was with:
Stringbuilder a=new Stringbuilder;
#Html.Raw(a.To.String())
Your code should technically work, if you are using MVC you could try
#MvcHtmlString.Create(p.Form);
I found a solution and now i solved it.
what i have done:
in my form the only part which are different from the others
forms are the dropdownlists.
i only put the part from <select> to </select> in my
database. (only the dynamically part of my form)
in my view i have write my form and only insert the variable
which comes from my controller to insert the data from my
database on the right part in my form.
here is the code:
<form action="/MyController/MyAction" method="post">
<input type="hidden" name="num" value="#ViewBag.num" />
#MvcHtmlString.Create(p.Form);
<button type="submit" name="submit" id="submit">OK</button>
</form>
So i have never more the problem with the variables to be
converted, because the variables are still the same

form verification before submitting

I have following form
<form id="myForm" action="/Problems/Post" method="post" enctype="multipart/form-data">
<input type="text" id="problemSubject" name="problemSubject" />
<input type="file" id="uploadFile" name="uploadFile"/>
<textarea rows="" cols="" class="form-textarea" id="problemDescription" name="problemDescription"></textarea>
</form>
I have to submit form to controller method(which i have done), but it should be first validated i.e. it should not contain empty fields. What i want is that "a message should appear telling that field is blank". How this can be done. Please help me. Thanks.
Take a look at some of the samples. (http://www.asp.net/mvc/tutorials/older-versions/javascript/creating-a-mvc-3-application-with-razor-and-unobtrusive-javascript)
Essentially you can validate on client side and on server side, which you should do both.
It is very easy to do validation in asp.net mvc3. Look at some tutorials like above.
Or this one: http://www.codeproject.com/Articles/249452/ASP-NET-MVC3-Validation-Basic
u can use server side validation controls...
plz hv a look [link]http://msdn.microsoft.com/en-us/library/aa479013.aspx
or use the jquery gven below--->
function callOnload(){
if($('#problemSubject').val() == '')
alert('fill the values');
if($('#uploadFile').val() == '')
alert('fill the values');
}

How to pass values from one Contact Form 7 form to another in Wordpress?

I have a site that has 2 forms - a short form and a long form. If you look at http://dforbesinsuranceagency.com you'll see the short form next to the masthead photo. The long form is at http://dforbesinsuranceagency.com/request-free-insurance-quotes/
When the user hits Submit on the short form, it kicks them over to the long form page, so that part works fine. The part that gives me fits is that I need the values entered into the short form fields First Name, Last Name, Email Address and Telephone passed to their equivalent fields on the long form.
How do I do this?
This is how I am redirecting the short form to the long form (I added it to the Additional Settings section for the short form):
on_sent_ok: "location = 'http://dforbesinsuranceagency.com//request-free-insurance-quotes';"
Any help would be appreciated.
Hack, hack, hackety, hack hack hack... Without suggesting "not using a form-builder" I don't think there is an elegant solution - you can't use the other PHP method suggested without modifying the plugin itself (and that is a can of worms). I will propose a Javascript solution but there are some caveats (below):
jQuery(document).ready(function($){
$('#quick-quote form:first').submit(function(){
var foo = {};
$(this).find('input[type=text], select').each(function(){
foo[$(this).attr('name')] = $(this).val();
});
document.cookie = 'formData='+JSON.stringify(foo);
});
var ff = $('#container form:first');
if(ff.length){
var data = $.parseJSON(
document.cookie.match('(^|;) ?formData=([^;]*)(;|$)')[2]
);
if(data){
for(var name in data){
ff.find('input[name='+name+'], select[name='+name+']').val(data[name]);
}
}
}
});
What this will essentially do is: on submission, store your mini-form options in a cookie. On page load it will then look for a form in the main body of the page and apply any stored cookie data.
Notes
The jQuery selectors are deliberately ambiguous to avoid any future changes in your admin panel/plugin that will likely screw with the form IDs (thus breaking the script).
I'm not faffing about pairing field/option names - for example the select box in your mini-form is named insurance-type however the matching box in the main form is named ins-type - you will have to ensure they are of the same name.
This also applies to select box values - if there is no matching value, it will be ignored (eg. some of your values in the main form have » » characters in front (and so don't match).
try this.
set the action of our first form to a php file named xyz.php
<form method="post" action="xyz.php">
<input type="text" name="name">
<input type="text" name="email_address">
<input type="submit" value="Go To Step 2">
</form>
the file xyz.php will create a new form for you which in this case is your second form (the big one). Set the action of the form as required. the code of your xyz.php will look something like this.
<form method="post" action="form3.php">
<input type="text" name="name" value="<?php echo $_POST['name']; ?>">
<input type="text" name="email_address" value="<?php echo $_POST['email_address']; ?>">
<input type="radio" group="membership_type" value="Free">
<input type="radio" group="membership_type" value="Normal">
<input type="radio" group="membership_type" value="Deluxe">
<input type="checkbox" name="terms_and_conditions">
<input type="submit" value="Go To Step 3">
</form>
where the input fields of the first form will already be filled with the details given by the user in the first form.
You can create the first form by yourself and let the contact form create the second form for you providing the default values using the method above.
Hope this helps!

Resources