Portswigger - Cross-origin resource sharing - Lab #1 CORS vulnerability with basic origin reflection

Hello Hackers, in this video of CORS vulnerability with basic origin reflection you will see how to exploit and discover Cross-origin resource sharing (CORS) in a lab from Web Security Academy powered by Portswigger

⚠️ Subscribe to my channel ➡️ @popo_hack ⚠️

0:00 - About the Lab
1:03 - Exploit vulnerable endpoint
2:56 - Testing Session cookie
4:15 - Exploit CORS vulnerability using Origin header
5:57 - Write milicous JavaScript code uses CORS to retrieve the administrator's API key
10:37 - Check Exploit server's Access log

🔍 About the Lab
Lab: CORS vulnerability with basic origin reflection
Level: Apprentice
This lab has an insecure CORS configuration in that it trusts all origins. To solve the lab, craft some JavaScript that uses CORS to retrieve the administrator's API key and upload the code to your exploit server. The lab is solved when you successfully submit the administrator's API key.

✅ What to do ?
1. Check intercept is off, then use the browser to log in and access your account page.

2. Review the history and observe that your key is retrieved via an AJAX request to /accountDetails, and the response contains the Access-Control-Allow-Credentials header suggesting that it may support CORS.

4. Observe that the origin is reflected in the Access-Control-Allow-Origin header.

5. In the browser, go to the exploit server and enter the following HTML, replacing YOUR-LAB-ID with your unique lab URL: Watch the video to see the code

6. Click View exploit. Observe that the exploit works - you have landed on the log page and your API key is in the URL.

7. Go back to the exploit server and click Deliver exploit to victim.

8. Click Access log, retrieve and submit the victim's API key to complete the lab.

Thank you for watching my video, if you have any questions or any topics recommendation feel free to write them on the comment below 🙋

#WebSecurityAcademy #portswigger #CORS #vulnerability

[huntit]

Watched 3 tutorial only your worked nice man

[aryanbj]

i used cookie editor extension. and i replaced session but when i refresh page with new session id it not work and not login with administrator

[Suviiii]

😭😭😭funally! As an adhd learner i approve this vid 😭😭😭🎀

[mykhailodudka]

I'm trying to complete this lab and I can't do it for 2 hours. I'm doing exactly as you did, but in acess log it shows me the api key of this wiener user instead of admisitrator. Maybe you have any idea what is the reason for this?

[montala]

This require admin needs to login 1st, then the admin need to open the malicious site, once the admin open it, the JS will auto run and send the data via us?

[acceshopping]

how can i see the access log in real bug after transfer it via burp suit

[التدريسالالكتروني]

can u do a video about writups related to cors