Perl-CGI Example-02: GET & HTML forms - Perl

Sh3llc0d3

So, in this example we have two scripts... a VERY basic HTML page and our perl-cgi script.

HTML Page - index.html

&lt;html&gt;
&lt;head&gt;
&lt;title&gt;&#46;&#46;&#58;&#58;iExploit Rules&#58;&#58;&#46;&#46;&lt;/title&gt;
&lt;/head&gt;

&lt;body&gt;
&lt;h1&gt;HTML test page for iExploit perl-cgi example&lt;/h1&gt;
&lt;hr /&gt;
&lt;p&gt;&lt;form method=\"GET\" action=\"cgi-bin/example&#46;cgi\"&gt;
Input text to display&#58; &lt;input type=\"text\" size=\"30\" maxlength=\"100\" name=\"input\"&gt; &lt;br /&gt;
&lt;input type=\"submit\" name=\"submit\" value=\"Print value!\"&gt;
&lt;/form&gt;&lt;/p&gt;
&lt;hr /&gt;
&lt;/body&gt;
&lt;/html&gt;

CGI script - example.cgi (placed in cgi-bin/ or where-ever you have cgi configured to run)

#!C&#58;/Perl64/bin/Perl&#46;exe -w
# Semtex-Primed
# Perl-CGI example2
# GET method using HTML form

    local ($buffer, @pairs, $pair, $name, $value, %FORM);
    $ENV{'REQUEST_METHOD'} =~ tr/a-z/A-Z/;
    if ($ENV{'REQUEST_METHOD'} eq \"GET\")
    {
	$buffer = $ENV{'QUERY_STRING'};
    }
    @pairs = split(/&/, $buffer);
    foreach $pair (@pairs)
    {
	($name, $value) = split(/=/, $pair);
	$value =~ tr/+/ /;
	$value =~ s/%(&#46;&#46;)/pack(\"C\", hex($1))/eg;
	$FORM{$name} = $value;
    }
    $input = $FORM{input};

print \"Content-type&#58;text/html\r\n\r\n\";
print \"&lt;html&gt;\";
print \"&lt;head&gt;\";
print \"&lt;title&gt;&#46;&#46;&#58;&#58;iExploit Rules&#58;&#58;&#46;&#46;&lt;/title&gt;\";
print \"&lt;/head&gt;\";
print \"&lt;body&gt;\";
print \"&lt;h1&gt;HTML test page for iExploit perl-cgi example&lt;/h1&gt;\";
print \"&lt;hr /&gt;\";
print \"&lt;h2&gt;The value you input is&#58; $input&lt;/h2&gt;\";
print \"&lt;hr /&gt;\";
print \"Thanks, Semtex-Primed\";
print \"&lt;/body&gt;\";
print \"&lt;/html&gt;\";

So let me walk you through whats going on here. In the HTML page your being asked to enter a value/word or whatever you want. The page then using the GET method sends the value to the perl-cgi script (notice action="cgi-bin/example.cgi"). But anyway this isn't a HTML forms tutorial so you should know that already.

Moving on to the cgi script, the script reads the values and splits the name of the incoming info and the value for the named input. We then put the value we want into a variable within the script. This is done here> "$input = $FORM{input};" 'input' on the html form is the name of that particular input being sent. So that corresponding value is read and saved to the variable $input.

Next we create a webpage using perl/cgi to output the data you input on index.html.

This script also demonstrates writing the html code line-by-line instead of using the block style in the last script.

Hope you've learned something more about the capabilities of perl-cgi and thanks. Again for cgi to work on your web-server you will need to enable it. I'll be writing a tutorial on how to enable/config it within apache2 soon.

s1n4

Thanks nice share ;)

Sh3llc0d3

said:

Thanks nice share ;)

No problem :)

chroniccommand

Might be worth while to mention sanitizing user input. CGI vulnerabilities are disasterous :P

Sh3llc0d3

said:

Might be worth while to mention sanitizing user input. CGI vulnerabilities are disasterous :P

...I would hope that everyone would look that up anyway. CGI vulnerabilities are no worse than other's, compromising the web-server is common in poorly written scripts, access with httpd privs is rare.

Xin

Good job semtex keep it up

Sh3llc0d3

Thanks Xin, obviously GET is somewhat of a hazard to use. What I'm going to do is come up with a script to use for sanitising input to these types of scripts.

Xin

said:

Thanks Xin, obviously GET is somewhat of a hazard to use. What I'm going to do is come up with a script to use for sanitising input to these types of scripts.

I wouldnt say GET requests are any more of a hazard than POST or any other times, they all get passed to the server the same way, its just what sanitisation you use.

Howdy, Stranger!

Top Posters

Who's Online (2)