Re: GET and POST Methods Accepted

[Paul Laudanski <zx () castlecops com>]

On Wed, 12 Oct 2005, Welsh, Ed wrote:

> Web sites are allowing a switch in method for requests and still processing the input.  I have been
> able to analyze a site login form which is specified to use POST method and craft a URL (GET of
> course) that the web server will still accept and process.  If the site will accept the GET method for
> form data and is vulnerable to XSS, the attack surface greatly increases over a site that is
> vulnerable to XSS but only accepts the POST method.  POST is still attackable, but it becomes more
> complicated than simply emailing a link.

Its easier for folks to copy direct links when params can be passed via 
GET, however, to your point, it would be much safer to permit such a thing 
if modsecurity is running.

---
Paul Laudanski, Microsoft MVP Windows-Security
http://castlecops.com - http://wiki.castlecops.com