The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Modifying the Request Method

In complex applications that employ a large number of forms, it is common to

find several reflected XSS vulnerabilities within 

POST

requests, where the vul-

nerable parameter is submitted within the body of an HTTP message. In these

cases, it is always worth verifying whether the application handles the request

in the same way if it is converted to a 

GET

request. Most applications will tol-

erate requests in either form.

To perform this check, simply change the method of your crafted request

from 

POST

to 

GET

, move the message body into the URL query string (inserting

an additional 

&

if a query string is already present), and remove the 

Content-

Length

header. You can use the Change Request Method action in Burp Proxy

to perform these tasks for you.

Test the new request, and if your XSS payload is still executed, then you can

simply use the URL from the 

GET

request as your attack vector. This makes fea-

sible a wider range of attack delivery mechanisms and, therefore, increases the

significance of the vulnerability in some contexts.