I have the following example POST request as part of a feedback form for a website that allows for an arbitrary value to be supplied to the "done_url" parameter, allowing for an open redirect after the feedback form has been processed.
POST /cgi-bin/formproc2.cgi HTTP/1.1
Host: foobar.com
mail_to=support%40support.com&subject=Feedback+Form&done_url=http://phishingsite.com&feedback=I+love+your+site&Submit=Submit
I am familiar with the typical forms of phishing done for open redirects in GET requests, such as this example http://www.secureworks.com/resources/blog/research/spam-government-websites-abused-ongoing-spam-campaign/
But how would an attacker exploit this redirect in the POST body?
bb
tags (used on blogs / forums / ....)) (if you could usename
/id
attribute too) & bypassing some URL fitlers on that site (so you cannot just insert arbitrary URL in[url]
bb tag:[url="any_url"]clickme[/url]
). Imho no general solution possible here, so you'll need to be very case speicific.$_REQUEST
is used instead of$_GET
/$_POST
, then you could convert that attack to GET and make it easily exploitable.