← all rooms
CORS
Medium
CORS Credential Theft
Reflected ACAO + credentials = steal the API response.
Mission briefing
ProfileAPI serves authenticated user JSON to a single-page app on another subdomain. Cross-origin rules reflect whatever Origin header the browser sends. See if a page you control can read another user's profile with their session.
0 / 1 tasks
0 / 10 pts
Room cleared
Every task in this room is done. Your rank progress just moved forward.
Objectives
- Abuse reflected Origin with credentials
Task 1 Reflected CORS Medium 10 pts
Scenario
ProfileAPI returns private JSON for the logged-in user at a me endpoint. Responses include Access-Control-Allow-Origin reflecting the request Origin. Steal the JSON from a page hosted on an attacker-controlled origin.
Your approach
- Log in and call the me API from browser dev tools to see normal data.
- Use the lab's evil origin simulator or your own page with fetch credentials.
- Confirm the browser exposes the response body cross-origin.
- Copy the flag field from the leaked JSON.
- Submit the CORS theft flag.
Probe /labs/cors/1/api/me from an evil origin.
Open lab →Hint
Use the Evil origin simulator on the lab page