I found a website which is not secure and tried to post a form on that site using cURL request in PHP and it worked successfully.

However, that is a simple site with contact form and no special or secure data. Anyone can fill that form. I just did that with curl with a loop of 100.

Is this a crime?

closed as off-topic by Polynomial, forest, Steffen Ullrich, schroeder Jan 13 at 20:54

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Polynomial, forest, Steffen Ullrich, schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 5
    That's going to depend on the law where you are located, and the law where the website is hosted – crunchy Jan 10 at 17:43
  • // , @VinitSingh, this is an example of a good subjective question! Would you mind expanding a little on a definition of the word "crime" as used here? – Nathan Basanese Jan 11 at 0:11
  • // , And of course, it might be courteous to send a gentle security comment, assuming that there's a way to do so anonymously. – Nathan Basanese Jan 11 at 0:13
  • 3
    Voting to close because this is a legal question, not a security question. As for whether doing this could be considered malicious - absolutely, yes. – Polynomial Jan 11 at 0:32
  • 1
    @NathanBasanese By "crime" i mean will it land me into some legal issue. Can owner of site file a complaint against me even though there was issue in there own site. – Vinit Singh Jan 11 at 6:15

Most browsers have developer tools which allow you to monitor all HTTP(S) requests sent by the browser, including an option to copy the requests as a cURL command. If you execute the request via cURL, it's indistinguishable from a 'real' browser request. Therefore, that is certainly not a crime.

If you're looping cURL requests, you're essentially trying to perform a Denial of Service attack; many countries/states have laws which state that this is a crime. Though 100 requests are not likely to constitute a successful attack, all it might do is fill the inbox of the mail account which receives completed forms.


I am not a lawyer, and the world is a large place with many conflicting laws, so I can't say anything about the legality of using cURL...

But from a technical standpoint, anything that you can do to their server with cURL, you can also do with a web browser. Anything that you can do to their server with a web browser, you can also do with cURL. They are simply programs that follow the HTTP protocol.

Of course, you can commit crimes with browsers, so it's possible to use cURL to commit crimes as well, but just the fact that you used cURL does not turn non-criminal browsing into a criminal act, unless the countries involved have some very specific laws.

To your specific point, if there is any crime in submitting data to a form on an insecure website 100 times in a row, then it shouldn't matter if you used cURL or if you just copy/pasted the information into the form and hit the submit button in the browser 100 times.

Not the answer you're looking for? Browse other questions tagged or ask your own question.