In this thread I will discussion how I was able to customize emails from api.data.gov and send it to a user of your choice.
Code :-
By inspecting the page we can see all the default values
Turns out all the values are able to be changed in the request on the clients side so that is what I did.
Some issue that I came across was the limit on the first_name parameter, meaning the contents of the email was limited. I was able to bypass this limit restriction using another paramter.
This is a cool method of inboxing phishing emails for example if i was targeting someone on *.data.gov i could craft this fully legit email.
Code :-
By inspecting the page we can see all the default values
Turns out all the values are able to be changed in the request on the clients side so that is what I did.
Some issue that I came across was the limit on the first_name parameter, meaning the contents of the email was limited. I was able to bypass this limit restriction using another paramter.
This is a cool method of inboxing phishing emails for example if i was targeting someone on *.data.gov i could craft this fully legit email.
