0

I found a website which is not secure and tried to post a form on that site using cURL request in PHP and it worked successfully.

However, that is a simple site with contact form and no special or secure data. Anyone can fill that form. I just did that with curl with a loop of 100.

Is this a crime?

  • 5
    That's going to depend on the law where you are located, and the law where the website is hosted – crunchy Jan 10 '19 at 17:43
  • // , @VinitSingh, this is an example of a good subjective question! Would you mind expanding a little on a definition of the word "crime" as used here? – Nathan Basanese Jan 11 '19 at 0:11
  • // , And of course, it might be courteous to send a gentle security comment, assuming that there's a way to do so anonymously. – Nathan Basanese Jan 11 '19 at 0:13
  • 3
    Voting to close because this is a legal question, not a security question. As for whether doing this could be considered malicious - absolutely, yes. – Polynomial Jan 11 '19 at 0:32
  • 1
    @NathanBasanese By "crime" i mean will it land me into some legal issue. Can owner of site file a complaint against me even though there was issue in there own site. – Vinit Singh Jan 11 '19 at 6:15
4

Most browsers have developer tools which allow you to monitor all HTTP(S) requests sent by the browser, including an option to copy the requests as a cURL command. If you execute the request via cURL, it's indistinguishable from a 'real' browser request. Therefore, that is certainly not a crime.

If you're looping cURL requests, you're essentially trying to perform a Denial of Service attack; many countries/states have laws which state that this is a crime. Though 100 requests are not likely to constitute a successful attack, all it might do is fill the inbox of the mail account which receives completed forms.

3

I am not a lawyer, and the world is a large place with many conflicting laws, so I can't say anything about the legality of using cURL...

But from a technical standpoint, anything that you can do to their server with cURL, you can also do with a web browser. Anything that you can do to their server with a web browser, you can also do with cURL. They are simply programs that follow the HTTP protocol.

Of course, you can commit crimes with browsers, so it's possible to use cURL to commit crimes as well, but just the fact that you used cURL does not turn non-criminal browsing into a criminal act, unless the countries involved have some very specific laws.

To your specific point, if there is any crime in submitting data to a form on an insecure website 100 times in a row, then it shouldn't matter if you used cURL or if you just copy/pasted the information into the form and hit the submit button in the browser 100 times.

Not the answer you're looking for? Browse other questions tagged or ask your own question.