Good morning,
I'm trying to make a script to automate SSI Injection tests.
The idea is to use curl to make the request to a form but I find the problem that when making the request, it is as if I made it to the login page.
I used the cookie that is generated when I login but still does not send the request where I want it.
I give an example of the pages and the script to see if it is better understood:
The login page is this:
http://192.168.0.103/bWAPP/login.php
And the page I want to make the request for is this:
http://192.168.0.103/bWAPP/ssii.php
And this is the cookie script:
curl --cookie 'PHPSESSID=2ffb41de99abf67ae7732d33af0214b1; security=low' -d 'firstname=prueba&lastname=prueba&form=submit' http://192.168.0.103/bWAPP/ssii.php -o prueba.txt.
To make it clearer, when I make a GET request the answer is the login page .. which is previous to the page I want to inject.
Does anyone know how I could do it in this case?
Thank you, best regards!