I currently have a demo site setup where I load the login form over HTTP and then POST to a HTTPS URL. The aim is to demonstrate that this is not a secure method of handling the login.
I'm using Fiddler to alter the target for the HTML form to a page of my own. I'm trying to capture the POST data but then forward the user to the genuine site with the original data so in effect my interception is invisible to the user.
I'm using PHP and I have everything working up to the point of the redirect so all the data is being stored in my database. I'm thinking perhaps a 307 including the original POST data but I'm not sure how to do this in PHP, can anyone help?