+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: CORS, the new HTML5 vector? (/showthread.php?tid=3931991)
CORS, the new HTML5 vector? - pwntoken - Dec 16, 2013
So I recently saw CORS are inevitably being the latest HTML5 vulnerability vector. I am not sure how we really get a POC for Cross Origin Resource Sharing vulnerability. There are better online POC generators tho like:
Code
http://attacker-site.com/html5/CORS/cors_tester.phpBut the dump it generates (if the site IS vulnerable) is encoded is some special formats. Like below:
[img]http://img.openfire-security.net/images/2013/12/16/GzC.gif[/img]
I am not really sure how to use this encoded form tho, does anyone has any idea, how we get to use CORS vulnerability on newly HTML5 based sites? or generate POC along with the vulnerability affection details? 👹
Thank you.
* - Gee4rce - Dec 16, 2013
Can't help you on that, (as i don't understand what you are looking for),
but at first you should fiy your image, it's not beeing displayed (well atleast for me)...
Greets, Gee.
* - pwntoken - Dec 17, 2013
(Dec 16, 2013 04:37 PM)Gee4rce Wrote: Can't help you on that, (as i don't understand what you are looking for),
but at first you should fiy your image, it's not beeing displayed (well atleast for me)...
Greets, Gee.
The image is fine. CORS is the new HTML5 vector for vulnerability, goes to WASC top lists. I have problems understanding this vector too.