Discover and read the best of Twitter Threads about #CORS
Most recents (3)
#Learn365 - Day 5⃣
CORS Headers. 🤔
What are they ? And how they bypass SOP ?
Learn about them in this thread 🧵👇
#infosec #bugbountytips #CORS #http
CORS Headers. 🤔
What are they ? And how they bypass SOP ?
Learn about them in this thread 🧵👇
#infosec #bugbountytips #CORS #http
In last thread, we talked about SOP, while SOP blocks the response, CORS is use to bypass SOP the most sensible way.
CORS is Cross Origin Resource Sharing.
It allows sharing response across different origins possible. Can we call it Bypassing SOP ?
Yes.
CORS is Cross Origin Resource Sharing.
It allows sharing response across different origins possible. Can we call it Bypassing SOP ?
Yes.
Lets say,
Domain A wants to Talk to Domain B for getting some information.
A
Domain A wants to Talk to Domain B for getting some information.
A
#Secret2
Bug Bounty with One-Line Bash Scripts💵😎
You can mention your favorite script. I will add them to this thread.
#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻
Bug Bounty with One-Line Bash Scripts💵😎
You can mention your favorite script. I will add them to this thread.
#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻
1/ #Secret2
🎯 Hunt #XSS:
👉🏻 cat targets.txt | anew | httpx -silent -threads 500 | xargs -I@ dalfox url @
👉🏻 cat targets.txt | getJS | httpx --match-regex "addEventListener\((?:'|\")message(?:'|\")"
#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻
🎯 Hunt #XSS:
👉🏻 cat targets.txt | anew | httpx -silent -threads 500 | xargs -I@ dalfox url @
👉🏻 cat targets.txt | getJS | httpx --match-regex "addEventListener\((?:'|\")message(?:'|\")"
#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻
2/ #Secret2
🎯 Hunt #SQLi:
👉🏻httpx -l targets.txt -silent -threads 1000 | xargs -I@ sh -c 'findomain -t @ -q | httpx -silent | anew | waybackurls | gf sqli >> sqli ; sqlmap -m sqli --batch --random-agent --level 1'
#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻
🎯 Hunt #SQLi:
👉🏻httpx -l targets.txt -silent -threads 1000 | xargs -I@ sh -c 'findomain -t @ -q | httpx -silent | anew | waybackurls | gf sqli >> sqli ; sqlmap -m sqli --batch --random-agent --level 1'
#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻
Having problems with #CORS (Cross Origin Resource Sharing) almost every time ?
Wondering why you mostly always run into a blocked request ?
Remember that it's all about 3 rules that aren't mutually exclusive.
I'll be writing about them in 10 mins time (don't miss it)
#Thread
Wondering why you mostly always run into a blocked request ?
Remember that it's all about 3 rules that aren't mutually exclusive.
I'll be writing about them in 10 mins time (don't miss it)
#Thread
What is CORS ?
Simply defined as a access control security restriction that is used to limit cross-domain communication based on the origin of a web site or app.
The key word here is Access Control - which is about authorization of http requests
#Thread \1
Simply defined as a access control security restriction that is used to limit cross-domain communication based on the origin of a web site or app.
The key word here is Access Control - which is about authorization of http requests
#Thread \1
Another key word is Origin: the origin is based off a combination of 2 things
1. A Scheme /Protocol( http / https )
2. A Host/Sub+Top Level Domain ( google.com )
Ok ? Cool!
Now you ask
How does this CORS thing actually work ?
#Thread \2
1. A Scheme /Protocol( http / https )
2. A Host/Sub+Top Level Domain ( google.com )
Ok ? Cool!
Now you ask
How does this CORS thing actually work ?
#Thread \2
