Take the 2-minute tour ×

I have the following example POST request as part of a feedback form for a website that allows for an arbitrary value to be supplied to the "done_url" parameter, allowing for an open redirect after the feedback form has been processed.

POST /cgi-bin/formproc2.cgi HTTP/1.1
Host: foobar.com


I am familiar with the typical forms of phishing done for open redirects in GET requests, such as this example http://www.secureworks.com/resources/blog/research/spam-government-websites-abused-ongoing-spam-campaign/

But how would an attacker exploit this redirect in the POST body?

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

Usually you would need to have this in a GET for it to be exploitable (in the sense of being able to redirect the user to an arbitrary URL after they've visited the link), however a couple of points occur about this

  • It might be possible to convert the POST to a GET and still have it process correctly, depends on the server-side logic.
  • That form may well have another issue which is that the target of the main is specified as a parameter. If an attacker can modify that parameter then they can use this form to send spam to arbitrary addresses. From a security standpoint the mail_to parameter should be held server-side not sent from the client (if it has to be sent from the client it should be white-list validated before the e-mail is actually sent)
share|improve this answer
Rory- you're completely correct. The only foreseeable method that this could be used as Phishing open redirect would be if it could be converted to a GET request, since the whole premise of the phishing attack relies on the victim seeing & trusting the link, and the hostname in the URL. –  eliteparakeet Sep 10 '13 at 21:09
add comment

Whatever could be done is irrelevant, since protecting such links is cheap and simple.

Pleas review this post, which proposes a general solution: Adding a security-token or none none.

share|improve this answer
add comment

Your Answer


