CORS - Lab #4 CORS vulnerability with internal network pivot attack | Long Video

[@cyberfiles8076]

Regarding the XSS, you CAN actually test this on the page we have access to, if you change the request method to GET. It may not have been the case when this video was recorded, as I notice some other small differences in the lab since the video came out. What made me try it was the fact that Rana herself uses a GET request to send the XSS payload. Thanks for the videos!

[@GilligansTravels]

Looking forward to the course!

[@GilligansTravels]

Reason 4 sold me!

[@mackeman1356]

thanks, you did great.

[@yazeedsalahat9227]

i dont have burpsuite pro

[@HassanRaza-ek3mv]

Sorry, i could not understand this lab.

[@TheBroadwood]

Hey Rana, i think that your code to fetch the csrf-token does not work properly. I tested it by sending the csrf token parsed from the HTML response to my burp collaborator instead of sending foundXSS=1. I found this out by doing the XSS labs and had to extract an csrf token to pass the lab and i failed using your function. PoC: (1) Your text.match(/csrf" value="([^"]+)"/) function xss_vector = '">'; leads to request to collaborator: GET /?csrf%22 HTTP/1.1 (2) Extracting the 2nd position [1] out of the resulting array from the match() function. xss_vector = '">'; or alternative xss_vector = '">'; will both lead to request to collaborator: GET /?GB9mbYqJlmG7smrWCl8g051Hlmxx35TJ HTTP/1.1 Nonethless this particular lab will still be solved with an invalid csrf token since it does not validate/need any credentials or tokens in order to delete the carlos user.

[@xnns8195]

text.match() is a javascript function and it is passed as src attribute of img tag i dont know what is she trying to do.....

[@yazeedsalahat9227]

i don't have burpsuite pro .. what can i use to solve this lab

[@coffinplayz]

​@@yazeedsalahat9227use crack burp