Automated Form Submission

Introduction

It is possible to automate the form submission process & submit multiple forms.

Impact

This vulnerability could cause loss of availability and results filling database with unwanted forms. This may leads to DOS(Denial of Service) attack to the server.

How To Test

Step1

• Go to the respective site (Eg: http://localhost/home.php)

• Open Burp suite Community Edition. Here, is the Blog to configuration on your browser.

• In burp suite, go to proxy tab and go to HTTP history. By capturing the above request when click “Click to Add” send this request to the intruder by right click on the packet.as shown in the below screenshots.

Step 2

In this intruder add the testing point for performing automated form submission by clicking Add as shown in the below screenshots.

In payloads tab set payload type as numbers, set the number range from 1 to 20 and start the attack as shown in the below screenshots.

For All the requests showing the response as 200 as shown in the below screenshots.

All the requests submitted successfully as shown in the below screenshot.

How To Fix

PHP

Sample Code: For client side

<form method="POST" action="add.php"> 
<?php $_SESSION['user_token'] = md5(uniqid()); ?>    àTo create the random session token using MD5 unique id function 
<input type="hidden" name="token" value="<?php echo $_SESSION['user_token'] ?>"/>  ->This token is stored in this hidden field 
<input type="test" name="textField" placeholder="Enter the data"> 
<input name="add" type="submit" value="Click to Add"> 
</form> 

For Server side,
<?php 
if(isset($_POST['add'])) 
{ 
$token = $_POST['token']; 
        if($token == $_SESSION['user_token'])   àChecking the token which is matching or not if it matches. Condition will be true and process the statements 
{ 
$textField = $_POST['textField']; 
$sql = "INSERT INTO records (sample) VALUES ('$textField')"; 
$conn->query($sql); 
$_SESSION['user_token'] = md5(uniqid());   à Generating new session token to avoid the automated form submission request 
echo 'Record inserted'; 
} 
        else       {                                                         
echo 'Record not inserted'; 
} 
} 
?> 

• We recommend implementing CAPTCHA that prevents automated form submission.

• Rate limit can be implemented in server side.