Upload image via multipart/form-data

[Fox]

@basmail said in Upload image via multipart/form-data:

Hello guys, I'm trying to upload an image via http but I always get a 400 response.
Is anyone of you good enough to see why its not well-formed multipart?

Thanks in advance

Form data sent as multipart/form-data:

Use the constructor

[basmail]

@Fox said in Upload image via multipart/form-data:

Use the constructor

Tried it, its not sending the full request somehow, here is the constructed request:

"x-amz-date",[[AMZ_DATE]],"x-amz-credential",[[AMZ_CRED]],"x-amz-algorithm",[[AMZ_ALGO]],"x-amz-signature",[[AMZ_SEG]],"Content-Type","image/jpeg","policy",[[AMZ_POLICY]],"x-amz-meta-user-id",[[AMZ_UID]],"key",[[AMZ_KEY]],"acl","public-read","file","base64://" + [[BASE64]]

Full post request from the HTTP Sniffer:

Content-Type: multipart/form-data; boundary=nlhmpcbxogehtvgecwbtlpmodwklktxbykkxobzj
Accept: */*



--nlhmpcbxogehtvgecwbtlpmodwklktxbykkxobzj
Content-Disposition: form-data; name="x-amz-date"; 

20231107T133536Z
--nlhmpcbxogehtvgecwbtlpmodwklktxbykkxobzj
Content-Disposition: form-data; name="x-amz-algorithm"; 

AWS4-HMAC-SHA256
--nlhmpcbxogehtvgecwbtlpmodwklktxbykkxobzj
Content-Disposition: form-data; name="file"; filename="file.jpg"
Content-Type: image/jpeg

�PNG


Response:

<Error><Code>InvalidArgument</Code><Message>Bucket POST must contain a field named 'key'.  If it is specified, please check the order of the fields.</Message><ArgumentName>key</ArgumentName><ArgumentValue></ArgumentValue><RequestId>CHQ6WT90FB9XJ6X0</RequestId><HostId>mHsNNdpEvGeU7iU5HO7FQoNTwC8gwCklmMaE3Ap7sm1Z0BG7kr6fF9LsMiryRYFwwg6SJ+OYJbfIlE1DuErT08tNHt9u7OJZ</HostId></Error>

Any idea why this happens?

Thanks

[Fox]

@basmail said in Upload image via multipart/form-data:

Any idea why this happens?

Sniff the requests from the browser and from the BAS, then compare them. This way you can find the cause.

[basmail]

@Fox said in Upload image via multipart/form-data:

@basmail said in Upload image via multipart/form-data:

Any idea why this happens?

Sniff the requests from the browser and from the BAS, then compare them. This way you can find the cause.

Yes I did this already, but BAS is just not sending the full request?? Of 10 parameters only 3 are sent?
If you look at the constructed request and compare it to the sent post request you will notice the difference.
Is there any way to fix this?

[Fox]

@basmail said in Upload image via multipart/form-data:

@Fox said in Upload image via multipart/form-data:

@basmail said in Upload image via multipart/form-data:

Any idea why this happens?

Sniff the requests from the browser and from the BAS, then compare them. This way you can find the cause.

Yes I did this already, but BAS is just not sending the full request?? Of 10 parameters only 3 are sent?
If you look at the constructed request and compare it to the sent post request you will notice the difference.
Is there any way to fix this?

Sometimes the sniffer BAS may not show all the data it sends. Try using Fiddler to analyze the BAS request and analyze the browser request

[basmail]

@Fox said in Upload image via multipart/form-data:

Sometimes the sniffer BAS may not show all the data it sends. Try using Fiddler to analyze the BAS request and analyze the browser request

Dont have to do this because the post response is "Bucket POST must contain a field named 'key'. If it is specified, please check the order of the fields."
Its just not getting sent.

Seems to be a BAS Bug then?!

[Fox]

@basmail said in Upload image via multipart/form-data:

@Fox said in Upload image via multipart/form-data:

Sometimes the sniffer BAS may not show all the data it sends. Try using Fiddler to analyze the BAS request and analyze the browser request

Dont have to do this because the post response is "Bucket POST must contain a field named 'key'. If it is specified, please check the order of the fields."
Its just not getting sent.

Seems to be a BAS Bug then?!

OK, you don't have to do what I say

[m4zuper]

Which site and which query are we talking about specifically? You can send it in private messages.

[basmail]

@Fox said in Upload image via multipart/form-data:

Sometimes the sniffer BAS may not show all the data it sends. Try using Fiddler to analyze the BAS request and analyze the browser request

But the constructed request looks like this:

"x-amz-date",[[AMZ_DATE]],"x-amz-credential",[[AMZ_CRED]],"x-amz-algorithm",[[AMZ_ALGO]],"x-amz-signature",[[AMZ_SEG]],"Content-Type","image/jpeg","policy",[[AMZ_POLICY]],"x-amz-meta-user-id",[[AMZ_UID]],"key",[[AMZ_KEY]],"acl","public-read","file","base64://" + [[BASE64]]

Does anyone know why there is so much missing in the request?

[Fox]

@basmail said in Upload image via multipart/form-data:

@Fox said in Upload image via multipart/form-data:

Sometimes the sniffer BAS may not show all the data it sends. Try using Fiddler to analyze the BAS request and analyze the browser request

But the constructed request looks like this:

"x-amz-date",[[AMZ_DATE]],"x-amz-credential",[[AMZ_CRED]],"x-amz-algorithm",[[AMZ_ALGO]],"x-amz-signature",[[AMZ_SEG]],"Content-Type","image/jpeg","policy",[[AMZ_POLICY]],"x-amz-meta-user-id",[[AMZ_UID]],"key",[[AMZ_KEY]],"acl","public-read","file","base64://" + [[BASE64]]

Does anyone know why there is so much missing in the request?

open the request completely, make sure that there is no data being sent after the image data

[basmail]

@Fox

wtf you are right, there is data after the image?

How is it possible to prevent this wrong order?

[Fox]

@basmail said in Upload image via multipart/form-data:

@Fox

wtf you are right, there is data after the image?

How is it possible to prevent this wrong order?

The server should accept data in any order, are you sure there are no more differences and the problem is only in the order of the data?

[basmail]

@Fox said in Upload image via multipart/form-data:

The server should accept data in any order, are you sure there are no more differences and the problem is only in the order of the data?

Everything else is the same, only the order is different when using constructed requests.
I mean the response is even "Bucket POST must contain a field named 'key'" but when you look at the image its here:

Before I grabbed the same value:

Even when I'm sending a invalid random key its the same response