Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using -headless in combination with -automatic-form-fill prevents form submission #656

Open
acardnell-intruder opened this issue Nov 8, 2023 · 2 comments
Labels
Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors.

Comments

@acardnell-intruder
Copy link

katana version:

Version 1.0.4

Current Behavior:

Running Katana with -headless and -automatic-form-fill no longer submits POST requests.

Expected Behavior:

Any rendered forms to be submitted in a similar fashion to the non-headless mode.

Steps To Reproduce:

Running the following command:

katana -u http://testphp.vulnweb.com -automatic-form-fill -proxy http://localhost:8080

I see these requests (proxied through Burp shown above):

image

However, if I run the same command with the addition of the -headless option, I no longer see the POST requests of the forms being sent.

image

If you need any more information let me know.

@acardnell-intruder acardnell-intruder added the Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors. label Nov 8, 2023
@acardnell-intruder
Copy link
Author

acardnell-intruder commented Nov 13, 2023

So I did a bit more investigation and found that if I run the command with the -verbose flag I see the following output in the console:

image

However, when monitoring those same requests it seems the POST requests are actually sent as GET requests with no arguments:

image

@ricky-algorime
Copy link

yea, not fixed in 1.0.5

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors.
Projects
None yet
Development

No branches or pull requests

3 participants
@acardnell-intruder @ricky-algorime and others