Form submission using POST menthod

@Sanford Whiteman‌ probably you can help me out here.

You can POST to /save (not /save2).

Use the case-sensitive core fields:

   munchkinId
   formid
   retURL (Thank You URL)
   _mkt_trk (Munchkin cookie)
   _mktoReferrer (URL of the page w/form)‍‍‍‍‍‍‍‍‍‍

/save is the same endpoint used by <noscript> form posts from Marketo LPs, so it's not really exotic in any way. While you can't open a Support case about it (like other advanced and/or experimental tactics) it's a reliable part of the Marketo ecosystem, up to its rate limit (30 form posts per second minute per IP).

https://xxxx.marketo.com/index.php/leadCapture/save2?formid=1234&munchkinId=xxx-xxx-xxx

You should be including the parameters in the body of the POST. Adding it to the URL is GET.

You can post to save2 server side (apparently you just need to add "formVid"). But warning that the anonymous IP address will be that of the server's and any inferred data will be incorrect.

CURL example in php

<?php
$fields = [
 'formid'=>1234,
 'formVid'=>1234,
 'munchkinId'=>'xxx-xxx-xxx',
 'Email'=>'abc@cba.com' // Email not email
];
$payload = '';
foreach($fields as $k=>$v) { $payload .= $k.'='.$v.'&';}
$payload = rtrim($payload , '&');
$ch = curl_init('https://xxxx.marketo.com/index.php/leadCapture/save2');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result = curl_exec($ch);
curl_close($ch);
?>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Hi Guys,

Munchkin ID and Form ID are available on every Marketo LP by using that value anyone can create the spam leads in any marketo instance using the above method. Is there any way to stop that?  /save or /save2 should not work directly and do not create any lead?

Thanks!