I work on web applications and as you know, having an administrator panel is a must in most cases. We can see that a lot of web applications have a specific login page for administrators in which there is a form (usually POST
method) that admins can use to login their panel.
But because the field names are known, a hacker can attempt to crack the passwords even if some security methods are implemented.
So what is the problem with a simple GET
key (as username) and its value (as password)? Why it's not used a lot or at least, is not suggested in many articles?
For administrators, user-friendly login pages are not really needed! Data will be logged in both cases (GET
/POST
) if there is a MiTM attacker.
But using this method, fields will be unknown expect for admins themselves. Here is a sample PHP code:
"category.php": (A meaningless page name)
<?php
if (isset($_GET['meaningless_user']) && $_GET['meaningless_word'] == "something"){
session_start();
$_SESSION["user"] = "test";
header('Location: category.php'); // Redirect to same or other page so GET parameters will disappear from the url
} else {
die(); // So it'll be like a blank page
}
?>
?myusername=mypassword
? Why couldn't you do the same with POST?