Fake a $_POST via PHP

Question

I'm all in a security funk right now so I'm going through making everything as secure as possible. I got a login going and I'm referencing this:

http://www.addedbytes.com/writing-secure-php/writing-secure-php-1/

The first example is that of a login and if you say ?authorization=1 you get in. But if I wrap my code around a if($_POST) then the user MUST make a post. Can a user fake a $_POST? How do I go about faking a $_POST?

The correct way to check the HTTP method would be $_SERVER['REQUEST_METHOD'], see http://php.net/manual/en/reserved.variables.server.php . Basically, all of those variables can be influenced by the client and cannot be trusted completely. — giraff, Jul 28 '11 at 19:25

score 15 · Accepted Answer · edited Jun 08 '18 at 15:44

15

A user can simply create a file on their local machine with:

<form action="http://yoursite.com/login.php" method="post">
    <input type="text" name="username"  value="hahaha faked it!" />
    <input type="text" name="password" value="hee hee you can't tell this is fake" />
    <input type="submit">
</form>

and boom, "fake" post. In other words, you have to assume that anything and everything the user sends is potentially fake.

edited Jun 08 '18 at 15:44

Zoe

27,060
21
118
148

answered Jul 28 '11 at 19:01

Marc B

356,200
43
426
500

ahh, yeah I just used inspect element to go in and change the action and added the "?authorization=1" - wow that was stupid easy to break. Thanks! – Howdy_McGee Jul 28 '11 at 19:02
2

+1 POST is just as easy to fake as GET. You should also explain a bit CSRF tokens. – Gabi Purcaru Jul 28 '11 at 19:03
1

DOM Inspectors are double-edged swords. They are great for both web development and fooling security measures. – Evan Mulawski Jul 28 '11 at 19:05
Disagree with @Gabi: GET Request may be a little bit simpler, not only for the script kiddies, but for XSS holes as well (e.g. ``) (CSRF Tokes are good, though, of course.) – giraff Jul 28 '11 at 19:16

score 4 · Answer 2 · edited Jun 08 '18 at 15:44

4

Yes they can.

With cURL and other HTTP clients, anybody can fake this.

Watch this

<form method="post" action="http://yoursite/index.php">
    <input type="text" name="authorization" value="1" /><input type="submit">
</form>

Then user saves this as .html in their computer, opens in theirbrowser. Then posts the form.

edited Jun 08 '18 at 15:44

Zoe

27,060
21
118
148

answered Jul 28 '11 at 19:01

ahmet alp balkan

42,679
38
138
214

score 4 · Answer 3 · answered Jul 28 '11 at 19:02

4

Two ways, make a curl request, or actually set the post variable on top of the php. E.g:

$_POST['var'] = "WHAT I WANT";

answered Jul 28 '11 at 19:02

NoviceCoding

6,145
2
27
33

score 2 · Answer 4 · answered Jul 28 '11 at 19:03

2

You can use cURL in PHP to POST like so:

$ch = curl_init();
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_TIMEOUT, 5);
curl_setopt($ch,CURLOPT_POST, 1); 
curl_exec($ch);
curl_close($ch);

answered Jul 28 '11 at 19:03

DSchultz

1,335
6
15

score 2 · Answer 5 · edited Jun 08 '18 at 15:43

The $_POST superglobal variable is populated from the query string that's contained in the body of an HTTP POST request. Since the user/client is the one who initiates the HTTP (POST & others) requests to the HTTP server, then yes - the client can "fake" a $_POST array's values & keys. Refer:

score 0 · Answer 6 · edited Jun 08 '18 at 15:44

In whatever page where the HTML is. Do this very first thing.

<?php
    session_start();
    /** Generate some random numbers */
    $wipit = rand(0,999999999);
    /** Store the WIPIT Generators value in the SESSSION */
    $_SESSION["WIPIT"] = $wipit;
?>

And do this in whatever page you are doing the POSTING validation and other things.

<?php
    session_start();
    /** Check for the REQUEST TYPE and SESSION WIPIT */
    if( isset( $_SERVER['REQUEST_METHOD']) == "POST" and isset($_SESSION["WIPIT"]) and !empty($_SESSION["WIPIT"]) ){
        /* Rest of your code goes here... */
    }
?>

score -1 · Answer 7 · answered May 10 '13 at 14:32

If your website has the problem of not escaping all text properly, it is an XSS weakness that can be exploited by a third party by injecting a (javascript-)script into the page which can use AJAX to send post requests with the users cookies and authority, with the least worst effect being that it could for example log out the user.

score -1 · Answer 8 · answered Jul 28 '11 at 19:01

-1

...yes a user can "fake" a post (whatever that means). Try tamper data on for size.

answered Jul 28 '11 at 19:01

Chris Eberle

47,994
12
82
119

Fake a $_POST via PHP

8 Answers8

Linked