Stealing Sensitive data with access-control-allow-origin header: *

Stealing Sensitive data with access-control-allow-origin header: * - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Stealing Sensitive data with access-control-allow-origin header: * (/showthread.php?tid=6090140)

Stealing Sensitive data with access-control-allow-origin header: * - MikeGolfRomeo - Jun 25, 2020

So I NiktoScanned a website and found that

+ Retrieved access-control-allow-origin header:

I navigated to the robots.txt and found this

User-agent: Disallow: /admin/ Disallow: /cache/ Disallow: /calendarjotter/ Disallow: /app/file/download/* Disallow: /downloadfile/* Disallow: /asset/* Sitemap: http://www.hawkedon.wokingham.sch.uk/sitemap.xml

It disallows /admin/.
How could I use a GET request to see all the data in the /admin and all the other forbidden directories?

RE: Stealing Sensitive data with access-control-allow-origin header: * - printf - Jun 25, 2020

Hello, I need a web penetration service, and I have several goals that require a database inside. I hope you can contact me, we can talk, I can pay bitcoin. My telegram: @li520

RE: Stealing Sensitive data with access-control-allow-origin header: * - christo - Jun 25, 2020

(Jun 25, 2020 10:40 AM)printf Wrote: Hello, I need a web penetration service, and I have several goals that require a database inside. I hope you can contact me, we can talk, I can pay bitcoin. My telegram: @li520

check my convo

RE: Stealing Sensitive data with access-control-allow-origin header: * - linkinpork - Jun 26, 2020

(Jun 25, 2020 09:14 AM)MikeGolfRomeo Wrote: So I NiktoScanned a website and found that

+ Retrieved access-control-allow-origin header: *

Hey, mate.
You got what's called a CORS vulnerability. Cross Origin Resource Sharing allows data to pass between websites. In your case, your target can interact with anyone, which means any website could leak the data from the target.

Wordpress used to have this bug, like, more than a year ago, until they fixed it by default.

I'm not going to go into the specifics, but this was the exploit page I made:
https://pastebin.com/vmtEFF59

(Jun 25, 2020 09:14 AM)MikeGolfRomeo Wrote: How could I use a GET request to see all the data in the /admin and all the other forbidden directories?

This one -- If I recall correctly I saw a bug report about someone editing the web.config and htaccess file to allow access to them. If you could put a RAT into the website, you can find the files to edit here:

Code 
www.website.com/.htaccess

www.website.com/web.config

I hope it goes well, mate

RE: Stealing Sensitive data with access-control-allow-origin header: * - MikeGolfRomeo - Jun 28, 2020

(Jun 26, 2020 10:22 PM)linkinpork Wrote: Hey, mate.
You got what's called a CORS vulnerability. Cross Origin Resource Sharing allows data to pass between websites. In your case, your target can interact with anyone, which means any website could leak the data from the target.

Wordpress used to have this bug, like, more than a year ago, until they fixed it by default.

I'm not going to go into the specifics, but this was the exploit page I made:
https://pastebin.com/vmtEFF59

This one -- If I recall correctly I saw a bug report about someone editing the web.config and htaccess file to allow access to them. If you could put a RAT into the website, you can find the files to edit here:

Code
www.website.com/.htaccess www.website.com/web.config

I hope it goes well, mate

Hey bro thanks for helping!
I was trying to use your exploit but it didn't seem to work....
This might be a bit much and a bit🥣🥣🥣but could you teach me how to do it for that website specifically?
I can't currently afford to pay but Ill try to repay you somehow 🙂

Edit:
These are some other things i found..

X-Frame-Options Not set
X-XSS-Protection Not set
Strict-Transport-Security Not set
X-Content-Type-Options Not Set

Ubuntu Operating Systems
Apache 2.4.43 Web Servers
PDF.js Miscellaneous
SWFObject Miscellaneous
Varnish Cache Tools
Google Font API Font Scripts
MediaElement.js Video Players
New Relic Analytics
jQuery JavaScript Frameworks

Thanks anyway
matt

RE: Stealing Sensitive data with access-control-allow-origin header: * - linkinpork - Jun 28, 2020

(Jun 28, 2020 08:54 AM)MikeGolfRomeo Wrote: Hey bro thanks for helping!
I was trying to use your exploit but it didn't seem to work....
This might be a bit much and a bit🥣🥣🥣but could you teach me how to do it for that website specifically?

Sure, I'll try. Hmu over convo.