{"action":"created","issue":{"url":"https://api.github.com/repos/Arachni/arachni/issues/517","labels_url":"https://api.github.com/repos/Arachni/arachni/issues/517/labels{/name}","comments_url":"https://api.github.com/repos/Arachni/arachni/issues/517/comments","events_url":"https://api.github.com/repos/Arachni/arachni/issues/517/events","html_url":"https://github.com/Arachni/arachni/issues/517","id":48200971,"number":517,"title":"How can I make Arachni  test AJAX \"unforms\"?","user":{"login":"sitsofe","id":4005180,"avatar_url":"https://avatars.githubusercontent.com/u/4005180?v=3","gravatar_id":"","url":"https://api.github.com/users/sitsofe","html_url":"https://github.com/sitsofe","followers_url":"https://api.github.com/users/sitsofe/followers","following_url":"https://api.github.com/users/sitsofe/following{/other_user}","gists_url":"https://api.github.com/users/sitsofe/gists{/gist_id}","starred_url":"https://api.github.com/users/sitsofe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sitsofe/subscriptions","organizations_url":"https://api.github.com/users/sitsofe/orgs","repos_url":"https://api.github.com/users/sitsofe/repos","events_url":"https://api.github.com/users/sitsofe/events{/privacy}","received_events_url":"https://api.github.com/users/sitsofe/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Arachni/arachni/labels/Feature%20request","name":"Feature request","color":"444444"}],"state":"closed","locked":false,"assignee":{"login":"Zapotek","id":375743,"avatar_url":"https://avatars.githubusercontent.com/u/375743?v=3","gravatar_id":"","url":"https://api.github.com/users/Zapotek","html_url":"https://github.com/Zapotek","followers_url":"https://api.github.com/users/Zapotek/followers","following_url":"https://api.github.com/users/Zapotek/following{/other_user}","gists_url":"https://api.github.com/users/Zapotek/gists{/gist_id}","starred_url":"https://api.github.com/users/Zapotek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Zapotek/subscriptions","organizations_url":"https://api.github.com/users/Zapotek/orgs","repos_url":"https://api.github.com/users/Zapotek/repos","events_url":"https://api.github.com/users/Zapotek/events{/privacy}","received_events_url":"https://api.github.com/users/Zapotek/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/Arachni/arachni/milestones/9","html_url":"https://github.com/Arachni/arachni/milestones/v1.1","labels_url":"https://api.github.com/repos/Arachni/arachni/milestones/9/labels","id":779988,"number":9,"title":"v1.1","description":"","creator":{"login":"Zapotek","id":375743,"avatar_url":"https://avatars.githubusercontent.com/u/375743?v=3","gravatar_id":"","url":"https://api.github.com/users/Zapotek","html_url":"https://github.com/Zapotek","followers_url":"https://api.github.com/users/Zapotek/followers","following_url":"https://api.github.com/users/Zapotek/following{/other_user}","gists_url":"https://api.github.com/users/Zapotek/gists{/gist_id}","starred_url":"https://api.github.com/users/Zapotek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Zapotek/subscriptions","organizations_url":"https://api.github.com/users/Zapotek/orgs","repos_url":"https://api.github.com/users/Zapotek/repos","events_url":"https://api.github.com/users/Zapotek/events{/privacy}","received_events_url":"https://api.github.com/users/Zapotek/received_events","type":"User","site_admin":false},"open_issues":0,"closed_issues":18,"state":"closed","created_at":"2014-09-05T16:24:18Z","updated_at":"2015-10-20T06:39:19Z","due_on":null,"closed_at":"2015-03-15T02:59:08Z"},"comments":8,"created_at":"2014-11-09T13:07:22Z","updated_at":"2015-10-20T19:33:30Z","closed_at":"2015-10-20T06:39:19Z","body":"I've found that Arachni seems to skip over AJAX submitted (un)forms when doing a normal scan. Here's an example:\r\n```php\r\n<?\r\nif ($_POST['choice'] == \"XSS\") {\r\n        echo $_POST['XSS']; # XSS Time!\r\n} else {\r\n?>\r\n<!DOCTYPE html>\r\n<html>\r\n<head>\r\n<title>Arachni AJAX unform test</title>\r\n<meta http-equiv=\"Content-Type\" content=\"text/html;charset=utf-8\">\r\n</head>\r\n<body>\r\n<script type=\"text/javascript\">\r\nfunction submit() {\r\n        var XHR = new XMLHttpRequest();\r\n        var data = {choice:'XSS', XSS:document.getElementById(\"XSS\").value};\r\n        var FD  = new FormData();\r\n\r\n        for(name in data) {\r\n        FD.append(name, data[name]);\r\n        }\r\n\r\n        XHR.addEventListener('load', function(event) {\r\n        document.getElementById(\"xhrresponse\").innerHTML = XHR.responseText;\r\n        });\r\n        XHR.open('POST', 'unform.php');\r\n        XHR.send(FD);\r\n}\r\n</script>\r\n<input id=\"XSS\" value=\"&lt;span style='color:red'&gt;XSS Time!&lt;/span&gt;\">\r\n<input type=\"submit\" value=\"XSS\" onclick=\"submit()\">\r\n<div id=\"xhrresponse\"></div>\r\n</body>\r\n</html>\r\n<?\r\n}\r\n?>\r\n```\r\n\r\nIs using Arachni's proxy the only way to get to such \"unforms\"?"},"comment":{"url":"https://api.github.com/repos/Arachni/arachni/issues/comments/149676987","html_url":"https://github.com/Arachni/arachni/issues/517#issuecomment-149676987","issue_url":"https://api.github.com/repos/Arachni/arachni/issues/517","id":149676987,"user":{"login":"sitsofe","id":4005180,"avatar_url":"https://avatars.githubusercontent.com/u/4005180?v=3","gravatar_id":"","url":"https://api.github.com/users/sitsofe","html_url":"https://github.com/sitsofe","followers_url":"https://api.github.com/users/sitsofe/followers","following_url":"https://api.github.com/users/sitsofe/following{/other_user}","gists_url":"https://api.github.com/users/sitsofe/gists{/gist_id}","starred_url":"https://api.github.com/users/sitsofe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sitsofe/subscriptions","organizations_url":"https://api.github.com/users/sitsofe/orgs","repos_url":"https://api.github.com/users/sitsofe/repos","events_url":"https://api.github.com/users/sitsofe/events{/privacy}","received_events_url":"https://api.github.com/users/sitsofe/received_events","type":"User","site_admin":false},"created_at":"2015-10-20T19:33:30Z","updated_at":"2015-10-20T19:33:30Z","body":"The latest download definitely fixes this. Thanks!"}}