CORS Vulnerability with Basic Origin Reflection | 2023

Portswigger’s Cross-Origin Resource Sharing Lab Simple Solution | Karthikeyan Nagaraj

Lab Description:

• This website has an insecure CORS configuration in that it trusts all origins.
• To solve the lab, craft some JavaScript that uses CORS to retrieve the administrator’s API key and upload the code to your exploit server.
• The lab is solved when you successfully submit the administrator’s API key.
• You can log in to your own account using the following credentials: wiener:peter

Analysis:

1. Turn your proxy On and …

basic bug bounty cors hacking origin portswigger vulnerability