Question

I have a private system that requires a user to login. It links to a separate webmail login page that requires users to enter the same credentials twice. I can pre-fill these fields in with html parameters, but I can’t seem to find a way to auto-submit. Is it possible? How?

Answer 1

You can exploit CSRF to log users in, if the webmail isn’t protected against CSRF attacks (yes, attack, as automatically submitting forms on 3rd party site is a risk).

<form action="https://*address of the webmail login page*" target="_blank">
<input type=hidden 
       name="*find what field names are used for login/pass*"
       value="username, etc">
</form>
<script>document.forms[document.forms.length-1].submit()</script>