Login form to an a secured app in tomcat

Question

I have a normal HTML page in a normal Apache http server (http://yyy.yyy.yyy.yyy/index.html ), with an authentication form, with that form I need to access with the credentials to an application located in other server with diferent IP , that server have a secured application with tomcat: here is the login form in the apache http server:

<form method="POST" id="theForm" 
      action="http://xxx.xxx.xxx.xxx:8080/securedapp/j_security_check"&gt;
  <input name="j_username" type="text" class="tx_form" id="j_username" size="20" />
  <input name="j_password" type="password" class="tx_form" id="textfield2" size="20" />
  <input name="btn" type="submit" value="login" />
</form>

the submit only works random in chrome and dont work in IE and FF. im doing something wrong?

Answer 1

You are missing a submit button. Chrome sends the values even without submit button when you press enter. Firefox and IE don't.

If you don't want the sumbit button (not recommended), you could try something like

<input type='text' name='bla' onKeyDown="if (window.event.keyCode==13) this.form.submit();">

Answer 2

I recommend installing tamperdata in firefox and then click the "start tamper" button in the tamperdata window. Click submit on the forum and then "tamper" the request. This will allow you to view and modify all of the data in a http request.

There maybe some differences when the request is sent from a remote server vs locally. For one the "referer" will be different and some applications check this as a form of CSRF protection. Another thing to keep an eye out for is missing get/post variables, you might have forgotten something or it maybe modified with javascript. Finley make sure that the content-type of the request is the same.

This is how you change the content type of a post request:

<form action="http://xxx.xxx.xxx.xxx:8080/securedapp/j_security_check"
    enctype="multipart/form-data"
    method="post">

Another option is to use Wireshark to capture the http reqeusts generated by chrome/ie/firefox. You can use a diff tool like Meld to compare packets.