faking post data

[mammothman42@hotmail.com]

i've copied my bank's login form and saved a copy on my computer.
However when i try to submit it, i get a 405 method not allowed error.
Can't for the life of me figure out why, it's posting exactly the same
data from exactly the same html code. Any ideas? It's a https (SSL)
site.

cheers
dave

[Bent Stigsen]

Re: faking post data

mammothman42@ho tmail.com wrote:[color=blue]
> i've copied my bank's login form and saved a copy on my computer.
> However when i try to submit it, i get a 405 method not allowed error.
> Can't for the life of me figure out why, it's posting exactly the same
> data from exactly the same html code. Any ideas? It's a https (SSL)
> site.[/color]

First a little speech. When you got the error "method not allowed",
didn't some bells and whistles go off in you head, followed by a thought
of "the bank probably doesn't want me to be doing this". Obviously they
are doing some additional checking to prevent misuse, not just to annoy
people.

Anyway, if you just copied the form and changed action to point to the
appropriate page, then the first obstacle is the referer[sic]-header. I
dont know of any ordinary browser which lets you fake that header, but
you can try cli-type webclients like wget and curl to explore that.
They (the bank) might require an ongoing session or kind of checksum, so
you would need to check for an id or other data in cookies, url or
hidden form-fields, which was related to the original loginform. I think
both wget and curl can help you there.
And there can be other "things".

As you probably suspect, anyhow they have done it, you would probably
need to write a mediator-script between your local form and the bank's
webserver. PHP has curl extensions which is useful for this purpose.

But seriously, check with the bank first. If they dont mind, they could
give you the information you need. If they do mind, then you shouldn't
be doing it in the first place.

/Bent

[Michael Vilain]

Re: faking post data

In article <4167d104$0$290 $edfadb0f@dread 14.news.tele.dk >,
Bent Stigsen <ngap@thevoid.d k> wrote:
[color=blue]
> mammothman42@ho tmail.com wrote:[color=green]
> > i've copied my bank's login form and saved a copy on my computer.
> > However when i try to submit it, i get a 405 method not allowed error.
> > Can't for the life of me figure out why, it's posting exactly the same
> > data from exactly the same html code. Any ideas? It's a https (SSL)
> > site.[/color]
>
> First a little speech. When you got the error "method not allowed",
> didn't some bells and whistles go off in you head, followed by a thought
> of "the bank probably doesn't want me to be doing this". Obviously they
> are doing some additional checking to prevent misuse, not just to annoy
> people.
>
> Anyway, if you just copied the form and changed action to point to the
> appropriate page, then the first obstacle is the referer[sic]-header. I
> dont know of any ordinary browser which lets you fake that header, but
> you can try cli-type webclients like wget and curl to explore that.
> They (the bank) might require an ongoing session or kind of checksum, so
> you would need to check for an id or other data in cookies, url or
> hidden form-fields, which was related to the original loginform. I think
> both wget and curl can help you there.
> And there can be other "things".
>
> As you probably suspect, anyhow they have done it, you would probably
> need to write a mediator-script between your local form and the bank's
> webserver. PHP has curl extensions which is useful for this purpose.
>
> But seriously, check with the bank first. If they dont mind, they could
> give you the information you need. If they do mind, then you shouldn't
> be doing it in the first place.
>
> /Bent[/color]

Gee, Brent. That was great. You just told someone how to setup a
phishing scam.

--
DeeDee, don't press that button! DeeDee! NO! Dee...

[Manuel Lemos]

Re: faking post data

Hello,

On 10/09/2004 06:45 AM, mammothman42@ho tmail.com wrote:[color=blue]
> i've copied my bank's login form and saved a copy on my computer.
> However when i try to submit it, i get a 405 method not allowed error.
> Can't for the life of me figure out why, it's posting exactly the same
> data from exactly the same html code. Any ideas? It's a https (SSL)
> site.[/color]

Error 405 usually happens when you try to submit a POST request to a URL
that serves a static page (read HTML page or something like that), not
really a dynamically generated page, there for submitting form requests
to a static page URL does not make sense, thus the 405 error.

If you want to emulate a login form using SSL or not, you may want to
try this HTTP client class. It supports SSL request, POST form
submissions as well cookie collecting and redirection which you
eventually also need.

http://www.phpclasses.org/httpclient

--

Regards,
Manuel Lemos

PHP Classes - Free ready to use OOP components written in PHP

http://www.phpclasses.org/

PHP Reviews - Reviews of PHP books and other products

http://www.phpclasses.org/reviews/

Metastorage - Data object relational mapping layer generator

http://www.meta-language.net/metastorage.html

[CJ Llewellyn]

Re: faking post data

<Michael Vilain <vilain@spamcop .net>> wrote in message
news:vilain-4B2F31.09530309 102004@comcast. dca.giganews.co m...
-snip-[color=blue]
> Gee, Brent. That was great. You just told someone how to setup a
> phishing scam.[/color]

No for a phishing scam, all you need to is copy the bank's form to your web
server and point it to your own CGI script.

[Bent Stigsen]

Re: faking post data

"Michael Vilain <vilain@spamcop .net>" wrote:[color=blue]
> In article <4167d104$0$290 $edfadb0f@dread 14.news.tele.dk >,
> Bent Stigsen <ngap@thevoid.d k> wrote:
>
>[color=green]
>>mammothman42@ hotmail.com wrote:
>>[color=darkred]
>>>i've copied my bank's login form and saved a copy on my computer.
>>>However when i try to submit it, i get a 405 method not allowed error.
>>>Can't for the life of me figure out why, it's posting exactly the same
>>>data from exactly the same html code. Any ideas? It's a https (SSL)
>>>site.[/color]
>>
>>First a little speech. When you got the error "method not allowed",
>>didn't some bells and whistles go off in you head, followed by a thought
>>of "the bank probably doesn't want me to be doing this". Obviously they
>>are doing some additional checking to prevent misuse, not just to annoy
>>people.
>>
>>Anyway, if you just copied the form and changed action to point to the
>>appropriate page, then the first obstacle is the referer[sic]-header. I
>>dont know of any ordinary browser which lets you fake that header, but
>>you can try cli-type webclients like wget and curl to explore that.
>>They (the bank) might require an ongoing session or kind of checksum, so
>>you would need to check for an id or other data in cookies, url or
>>hidden form-fields, which was related to the original loginform. I think
>>both wget and curl can help you there.
>>And there can be other "things".
>>
>>As you probably suspect, anyhow they have done it, you would probably
>>need to write a mediator-script between your local form and the bank's
>>webserver. PHP has curl extensions which is useful for this purpose.
>>
>>But seriously, check with the bank first. If they dont mind, they could
>>give you the information you need. If they do mind, then you shouldn't
>>be doing it in the first place.
>>
>>/Bent[/color]
>
>
> Gee, Brent. That was great. You just told someone how to setup a
> phishing scam.[/color]

Well, the way I see it...
<rant>
Keeping something a secret will not protect anybody. And this is just
too easy for anybody to do. The only difference is, if they are smart
enough to avoid getting caught. And the smart ones probably know this in
the first place. I think beating some decency into people, instead of
keeping secrets is far better.

About security and phishing. Banks and others who require tight security
really needs to do other "things" as I hinted. If they dont, then they
are a joke. In general if people got over this sense of false security
and where more alert, and service providers took it more seriously, then
phishing would be dead.

Secrecy has never ever been a substitute for security.
</rant>

Dont get me wrong though, like you, I am also worried about people being
scammed, but I just think that in the long run this is better.

/Bent

[davefromalbury]

Re: faking post data


Bent Stigsen wrote:[color=blue]
> "Michael Vilain <vilain@spamcop .net>" wrote:[color=green]
> > In article <4167d104$0$290 $edfadb0f@dread 14.news.tele.dk >,
> > Bent Stigsen <ngap@thevoid.d k> wrote:
> >
> >[color=darkred]
> >>mammothman42@ hotmail.com wrote:
> >>
> >>>i've copied my bank's login form and saved a copy on my computer.
> >>>However when i try to submit it, i get a 405 method not allowed[/color][/color][/color]
error.[color=blue][color=green][color=darkred]
> >>>Can't for the life of me figure out why, it's posting exactly the[/color][/color][/color]
same[color=blue][color=green][color=darkred]
> >>>data from exactly the same html code. Any ideas? It's a https[/color][/color][/color]
(SSL)[color=blue][color=green][color=darkred]
> >>>site.
> >>
> >>First a little speech. When you got the error "method not allowed",[/color][/color][/color]
[color=blue][color=green][color=darkred]
> >>didn't some bells and whistles go off in you head, followed by a[/color][/color][/color]
thought[color=blue][color=green][color=darkred]
> >>of "the bank probably doesn't want me to be doing this". Obviously[/color][/color][/color]
they[color=blue][color=green][color=darkred]
> >>are doing some additional checking to prevent misuse, not just to[/color][/color][/color]
annoy[color=blue][color=green][color=darkred]
> >>people.
> >>
> >>Anyway, if you just copied the form and changed action to point to[/color][/color][/color]
the[color=blue][color=green][color=darkred]
> >>appropriate page, then the first obstacle is the[/color][/color][/color]
referer[sic]-header. I[color=blue][color=green][color=darkred]
> >>dont know of any ordinary browser which lets you fake that header,[/color][/color][/color]
but[color=blue][color=green][color=darkred]
> >>you can try cli-type webclients like wget and curl to explore that.
> >>They (the bank) might require an ongoing session or kind of[/color][/color][/color]
checksum, so[color=blue][color=green][color=darkred]
> >>you would need to check for an id or other data in cookies, url or
> >>hidden form-fields, which was related to the original loginform. I[/color][/color][/color]
think[color=blue][color=green][color=darkred]
> >>both wget and curl can help you there.
> >>And there can be other "things".
> >>
> >>As you probably suspect, anyhow they have done it, you would[/color][/color][/color]
probably[color=blue][color=green][color=darkred]
> >>need to write a mediator-script between your local form and the[/color][/color][/color]
bank's[color=blue][color=green][color=darkred]
> >>webserver. PHP has curl extensions which is useful for this[/color][/color][/color]
purpose.[color=blue][color=green][color=darkred]
> >>
> >>But seriously, check with the bank first. If they dont mind, they[/color][/color][/color]
could[color=blue][color=green][color=darkred]
> >>give you the information you need. If they do mind, then you[/color][/color][/color]
shouldn't[color=blue][color=green][color=darkred]
> >>be doing it in the first place.
> >>
> >>/Bent[/color]
> >
> >
> > Gee, Brent. That was great. You just told someone how to setup a
> > phishing scam.[/color]
>
> Well, the way I see it...
> <rant>
> Keeping something a secret will not protect anybody. And this is just[/color]
[color=blue]
> too easy for anybody to do. The only difference is, if they are smart[/color]
[color=blue]
> enough to avoid getting caught. And the smart ones probably know this[/color]
in[color=blue]
> the first place. I think beating some decency into people, instead of[/color]
[color=blue]
> keeping secrets is far better.
>
> About security and phishing. Banks and others who require tight[/color]
security[color=blue]
> really needs to do other "things" as I hinted. If they dont, then[/color]
they[color=blue]
> are a joke. In general if people got over this sense of false[/color]
security[color=blue]
> and where more alert, and service providers took it more seriously,[/color]
then[color=blue]
> phishing would be dead.
>
> Secrecy has never ever been a substitute for security.
> </rant>
>
> Dont get me wrong though, like you, I am also worried about people[/color]
being[color=blue]
> scammed, but I just think that in the long run this is better.
>
> /Bent[/color]