Testing cross-origin resource sharing
To understand cross-origin resource sharing (CORS) vulnerability, first, you have to understand the same-origin policy. The same-origin policy was created to restrict the ability of websites to access resources that are not from the source domain. Although for some websites the same-origin policy is a problem, many websites nowadays interact with subdomains or third-party websites that need cross-origin exceptions. CORS was created to resolve this issue.
Getting ready
This lab requires a PortSwigger Academy account and ZAP to intercept requests and responses from the server to your browser. The login credentials for the lab web application are as follows:
- Username:
wiener - Password:
peter
How to do it...
In this recipe, the lab introduces a vulnerable website with an insecure CORS configuration to trust all origins. To solve this, we’ll form a malicious JavaScript function using CORS to retrieve an administrator...
