[g37752]

I use Live Http Header to show what's passed, and all i got is

POST /dir1/dir2/update {"var1":"val1","var2":"val2","var3":"val3"}

i tried this and got request denied

curl -b cookie -c cookie -L "http://rootdomain.com/dir1/dir2/update" -d "{\"var1\":\"val1\",\"var2\":\"val2\",\"var3\":\"val3\"}" 

i tried this and got 'page not found'

curl -b cookie -c cookie -L "http://rootdomain.com/dir1/dir2/update?var1=val1&var2=val2&var3=val3" -d ""

how do i get this to work?

[Atli]

Do you control the target site?

It looks to me like the target site is set up to serve only a specific source, like the AJAX requests from it's own Javascript. Your POST request is probably denied because some criteria is missing, like the HTTP_X_REQUESTED_WITH header sent with AJAX requests (from jQuery, at least). The GET request is failing most likely because the server is expecting a POST request. Some front-controllers differentiate between request types when they route requests, so a GET request to a route registered only for POST requests may well return a 404 status.

[g37752]

I used Live Http Header which does not give me any more info. How can i find out what else is passed?

i did not think the 2nd request was a GET request since i used the "-d" flag. i also saw in my own site where a POST request passed stuff in the URL too?

[Atli]

g37752, on 28 January 2013 - 01:47 AM, said:

I used Live Http Header which does not give me any more info. How can i find out what else is passed?

Are you sure? If you are talking about the Live HTTP Headers AddOn for Firefox, then it should give you all the relevant info for the AJAX request; both the request and response headers. - If you go into the "Headers" tab and tag "Capture" at the bottom, it should display all that data in the list.

g37752, on 28 January 2013 - 01:47 AM, said:

i did not think the 2nd request was a GET request since i used the "-d" flag. i also saw in my own site where a POST request passed stuff in the URL too?

Yea, OK, that's probably true. I was assuming an empty data string would nullify the effect. It probably doesn't.

You can use a GET query string in a POST request as well on most HTTP servers these days, that's true. However the server-side application may not accept a POST request unless it has some data, or even unless it has a list of specific data fields set.

[g37752]

Atli, on 27 January 2013 - 04:26 PM, said:

Do you control the target site?

It looks to me like the target site is set up to serve only a specific source, like the AJAX requests from it's own Javascript. Your POST request is probably denied because some criteria is missing, like the HTTP_X_REQUESTED_WITH header sent with AJAX requests (from jQuery, at least). The GET request is failing most likely because the server is expecting a POST request. Some front-controllers differentiate between request types when they route requests, so a GET request to a route registered only for POST requests may well return a 404 status.

i added

-H "X-Requested-With: XMLHttpRequest"

so it becomes:

curl -b cookie -c cookie -H "X-Requested-With: XMLHttpRequest" -L "http://rootdomain.com/dir1/dir2/update" -d "{\"var1\":\"val1\",\"var2\":\"val2\",\"var3\":\"val3\"}

but still get request denied - you dont have permission to access this page?

what i used to do is put everything under 'content' in data '-d'. in this case, it does not show 'content'. the jquery data is right after 'Cache-Control: no-cache'

This post has been edited by g37752: 27 January 2013 - 09:53 PM

[Atli]

OK, then there is some other criteria missing. The only sure way to figure out what that is is to take a look at the server-side code on the target site; to figure out what the server is expecting. I can't really tell you what that is, you'll either have to look at the code or contact somebody who has access to that info.