Nur Gucu nuryslyrt

Handle CORS Client-side

Cross-origin resource sharing (CORS) is a mechanism that allows restricted resources (e.g. fonts) on a web page to be requested from another domain outside the domain from which the first resource was served. This is set on the server-side and there is nothing you can do from the client-side to change that setting, that is up to the server/API. There are some ways to get around it tho.

Sources : MDN - HTTP Access Control | Wiki - CORS

CORS is set server-side by supplying each request with additional headers which allow requests to be requested outside of the own domain, for example to your localhost. This is primarily set by the header:

Access-Control-Allow-Origin

Description

This is a simple guide to perform javascript recon in the bugbounty

Steps

The first step is to collect possibly several javascript files (more files = more paths,parameters -> more vulns)

CVE-2019-5418 Demo

Build Docker container: Dockerfile

FROM ruby:2.5
RUN apt-get update -qq && apt-get install -y nodejs postgresql-client
RUN mkdir /myapp
WORKDIR /myapp
COPY Gemfile /myapp/Gemfile

	package main

	import (
	"fmt"
	"math"
	)

	// Golang program for
	// Display mersenne prime numbers from 1 to n

	public class RootUtil {
	public static boolean isDeviceRooted() {
	return checkRootMethod1() \|\| checkRootMethod2() \|\| checkRootMethod3();
	}

	private static boolean checkRootMethod1() {
	String buildTags = android.os.Build.TAGS;
	return buildTags != null && buildTags.contains("test-keys");
	}

	/*
	Android SSL Re-pinning frida script v0.2 030417-pier

	$ adb push burpca-cert-der.crt /data/local/tmp/cert-der.crt
	$ frida -U -f it.app.mobile -l frida-android-repinning.js --no-pause

	https://techblog.mediaservice.net/2017/07/universal-android-ssl-pinning-bypass-with-frida/

	UPDATE 20191605: Fixed undeclared var. Thanks to @oleavr and @ehsanpc9999 !
	*/

	package okhttp3;

	import java.security.cert.Certificate;
	import java.security.cert.X509Certificate;
	import java.util.ArrayList;
	import java.util.Arrays;
	import java.util.Collections;
	import java.util.LinkedHashSet;
	import java.util.List;
	import java.util.Set;

	/*
	Fun interactive Business Card Idea
	Definitely Hover Things */

	var secret = document.querySelector('#WINKWINK');
	var wink = document.querySelector('#wink');

	secret.addEventListener('mouseover', function(){
	wink.classList.add('active')
	});

	$Shares = Get-ChildItem "C:\test123" -Recurse \| Get-ACL \| ?{$_.AccessToString -match "Everyone"} \| %{($_.PSPath -split '::')[1]};
	foreach($Share in $Shares) {
	findstr /r "[0-9][0-9]\.[0-9][0-9]\.[0-9][0-9]\.[0-9][0-9]" $Share;
	findstr /rs "pass" $Share;
	}