Closed Grizzly2000 closed 3 weeks ago
__ __ / /_____ _/ /____ ____ ___ _ / '_/ _ / __/ _ / _ \/ _ / /_/\_\\_,_/\__/\_,_/_//_/\_,_/ projectdiscovery.io [INF] Current version: v1.1.0
Using '-form-extraction' option, the extraction of form data is ignored when the action field of the "form" tag is set to "#".
To fix the issue, simply replace the value "#" with an empty string ("") in extracted action field.
Suggested Fix: To fix the problem, add the following code at line 27 of the file pkg/utils/formfields.go:
if action == "#" { action = "" }
Go to File : https://github.com/projectdiscovery/katana/blob/main/pkg/utils/formfields.go#L27
./katana -u https://pentest-ground.com:4280/vulnerabilities/sqli/ -fx -j -or -ob -crawl-scope https://pentest-ground.com:4280/vulnerabilities/sqli/| jq '.response.forms | select( . != null )'
With the patch
__ __ / /_____ _/ /____ ____ ___ _ / '_/ _ / __/ _ / _ \/ _ / /_/\_\\_,_/\__/\_,_/_//_/\_,_/ projectdiscovery.io [INF] Current katana version v1.1.0 (latest) [INF] Started standard crawling for => https://pentest-ground.com:4280/vulnerabilities/sqli/ [ { "method": "GET", "action": "https://pentest-ground.com:4280/vulnerabilities/sqli/", "parameters": [ "id", "Submit" ] } ]
Without the patch
__ __ / /_____ _/ /____ ____ ___ _ / '_/ _ / __/ _ / _ \/ _ / /_/\_\\_,_/\__/\_,_/_//_/\_,_/ projectdiscovery.io [INF] Current katana version v1.1.0 (latest) [INF] Started standard crawling for => https://pentest-ground.com:4280/vulnerabilities/sqli/
Thanks ! :)
katana version:
Current Behavior:
Using '-form-extraction' option, the extraction of form data is ignored when the action field of the "form" tag is set to "#".
Expected Behavior:
To fix the issue, simply replace the value "#" with an empty string ("") in extracted action field.
Suggested Fix: To fix the problem, add the following code at line 27 of the file pkg/utils/formfields.go:
Go to File : https://github.com/projectdiscovery/katana/blob/main/pkg/utils/formfields.go#L27
Steps To Reproduce:
With the patch
Without the patch
Thanks ! :)