CORS vulnerability with basic origin reflection (Video solution)

[@santiago0072002pr]

there it goes: i just catch one thing in the video that I was doing wrong. I was copying the URL that the exploit server has on top instead of copying the URL from the link on the lab itself where it tells you the account details. it took me more than a week to solve this bad boy.

[@quanhlazie2187]

thanks a lot... same to me

[@MrLafk]

How is it possible to see the admin api key if we are requesting the resource as the wiener user?

[@talha7851]

Yep, how does that work?

[@EagleTube1337]

if u see clearly , it click button send to victims , the victim is administrator so the site automatically as a dummy administrator clicked and get the response there , it same way when u have the payload and just send to victim , but in reality must have to wait the victim click , in this situation that site already coded for automatically click the malicious code

[@cair0_]

what is the use of /log?key= and where it's located someone help pls

[@santiago0072002pr]

for some reason I am doing the same steps you are doing and all i get is a resource not found on the log part of the API keys. I have been stuck in this lab for about a week now.

[@levilawliet5762]

There has to be a problem with the URL you are pasting, if you took the code snippet from the answer section, then make sure you remove "$URL".

[@ARMIN1988ARMIN]

copy the url from the application page, the page where you have logged and you can see "we like to shop", the url ends with academy.net. Paste this instead of the url placeholder, and don't erase /accountDetails', true... then for sure you can see your API in the url. Once you deliver the exploit, go to the log files, check the last the urls, the one that includes administrator, also includes url encoded key, copy that, url decode, then you have got the Admin API key. Good luck.

[@GauravYadav-nd9st]

we havent changed the id to administrator in request then how we are getting api key of admin in logs.????

[@EagleTube1337]

if u see clearly , it click button send to victims , the victim is administrator so the site automatically as a dummy administrator clicked and get the response there , it same way when u have the payload and just send to victim , but in reality must have to wait the victim click , in this situation that site already coded for automatically click the malicious code

[@ARMIN1988ARMIN]

Thanks a lot Michael.

[@faresmahmoud7826]

thank you my dude

[@monKeman495]

"Resource%20not%20found%20-%20Academy%20Exploit%20Server"