Cross-Origin Resource Sharing (CORS) | Complete Guide

Подписаться 77 тыс.

Просмотров 66 тыс.

50% 1

In this video, we cover the theory behind Cross-Origin Resource Sharing (CORS) vulnerabilities, how to find these types of vulnerabilities from both a white box and black box perspective, how to exploit them and how to prevent them.
▬ ✨ Support Me ✨ ▬▬▬▬▬▬▬▬▬▬
Buy my course: bit.ly/30LWAtE
▬ 📖 Contents of this video 📖 ▬▬▬▬▬▬▬▬▬▬
00:00 - Introduction
00:31 - Web Security Academy Course (bit.ly/30LWAtE)
01:42 - Agenda
02:30 - What is a CORS vulnerability?
33:35 - How to find CORS vulnerabilities?
42:37 - How to exploit CORS vulnerabilities?
50:25 - How to prevent CORS vulnerabilities?
51:47 - Resources
52:00 - Thank You
▬ 🔗 Links 🔗 ▬▬▬▬▬▬▬▬▬▬
Video slides: github.com/rkhal101/Web-Secur...
Web Security Academy: portswigger.net/web-security/...
Rana's Twitter account: / rana__khalil
Hacker Icons made by Freepik: www.freepik.com

Наука

Опубликовано:

6 июл 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 78

@RanaKhalil101 2 года назад

Don't want to wait for the weekly release schedule to gain access to all the videos and want to be added to a discord server where you can ask questions? Make sure to sign up to my course: bit.ly/30LWAtE ✨✨

@Shintowel Год назад

Love u

@akr2dev Год назад

Is your course available as one time purchase? Or I have to renew each month to keep access

@RanaKhalil101 Год назад

@@akr2dev One time purchase

@akr2dev Год назад

@@RanaKhalil101 I was looking for a course that covers CORS. I think I am so lucky to find your course It will take me to a whole another level :) Thank you ~

@klliiyougg6666 11 месяцев назад

Why you speak englih why

@CookingCooking77 2 месяца назад

You explain in the exact way a beginner would liked to be explained !

@rohanadhvaryu 2 года назад

This is the best ever explaination I have seen on an internet for the CORS topic, what an explaination!! Each and every details are covered here to understand it deeply and properly in a very easy language. I really appreciate. Thank you and and please keep it up. 🙂❤🙌

@rahulaga 3 месяца назад

totally agree on clarity of explanation !!

@VladislavSnegurov Год назад

I had so many confusion with Same-Origin-Policy and CORS, you made it clear for me once and forever. The most brilliant part of your lecture is that you provide real step-by-step case of attacking and exploiting vulnerability. Most explanations in Internet are just few general statements that produce more questions than answers. Thank you!

@faique2995 2 года назад

You are among the best teacher I have ever met in my life ♥️

@Thomas_Grusz 8 месяцев назад

This is the best explanation of CORS and SOP I have come accross so far. Thank you!

@mr.agoristgoldstein9109 Год назад

Signed up for Academy! Man what a deal….I am very grateful for your content. Thank you 🙏🏻

@bhaskarvaka3931 Год назад

Wow ! The best video on CORS. This helps me to work on the solution for the issue identified in my application. Thank you so much!

@hebafarahat Год назад

I love how you always simplify things. You are amazing! keep it up Rana 🔥💪

@danmcgirr4210 2 года назад

You are amazing! Thanks for sharing so much knowledge. I've just found your academy through your Twitter. I'm looking forward to joining and training under your guidance. All the best!

@squarebyte9846 2 года назад

Great video! This makes CORS so easy to understand :D

@vicmann87 2 месяца назад

This video has the best explanation that I've ever seen about this topic

@kutra100 8 месяцев назад

Excellent. Made it easy to understand and grasp. Thank you !

@0x_Eslam 13 дней назад

Love u sis❤ i hope u will be in jannah inshallah❤❤

@jmukarram 2 года назад

Very informative video. Thanks for sharing your knowledge and skill.

@RafaelFoschiani 7 месяцев назад

Come here because i was having some issues with AWS Cloudfront/S3 CORS configuration, and find out a lot of vulnerabilties in the existing confgs LMAO. Thank you so much!

@TomAinsworth94 Год назад

Thanks a lot for the video Rana, it’s super helpful!

@korean6525 2 года назад

Wonderful explanation!

@MereAYT Месяц назад

This is really good and I am saving it ot watch a few times until it all clicks. Thanks!

@ankurarora1606 2 года назад

Love your way of teaching

@211986abhi Год назад

Wow 👌 beautifully explained. Your work is amazing. Totally impressed.

@pascalerb5572 Год назад

Real good video! Thanks for this awesome work!

@sp1460 Год назад

Your teaching skills are great. Thanks. Hope you make more videos on various topics.

@vishalsharma-nx2fq Год назад

Excellent video what a detailed explanation... Kudos to you

@youssef_emad19 Год назад

You are my role model in this field

@dor1313 Год назад

Wow ! such a great explanation ! like & subscribed!

@abdallahazme4757 2 месяца назад

For a full stack developer like me this was super super useful, SO MANY THANKS.

@jc_alpha Год назад

Perfect explanation. Thank you!

@ChillTamizha 9 месяцев назад

Nice video thanks for the resources that were shared in this video 👏

@user-lq3xl5xd5j 5 месяцев назад

This is the best explanation of CORS and SOP I Thank you, even your language it's easy to consider again thank you

@marclemessy2063 Год назад

thank you very much for your explanation, you were very clear. Keep it up

@titanicsinclair1577 2 года назад

finally new series is back after some time!

@jogadornumerozero3257 Год назад

This channel is awesome, thank u soo much

@gauravkelkar4273 Год назад

Amazing explanation!!

@petebarnard123 11 месяцев назад

Brilliant explanation. thanks

@shaifsec 24 дня назад

This is awesome contenet about CORS.

@burhanshah5855 Год назад

Absolutely fantastic Rana

@jzbainabsbsosmsidnidnsi2647 11 месяцев назад

Thanks Rhana. You are the best🎉

@mahalingappabirajdar5285 Год назад

Great Explanation!!!!!!!

@timecop1983Two 5 месяцев назад

You are the best web HACKER I know!!! Keep up you're amazing content. I could not find Cross-Origin Resource Sharing on youtube but then I remeber you were in a david bombal show. So, keep it up... 👍👌✌

@cheolwang4389 Год назад

great job. love it!

@Ayushnigam806 5 месяцев назад

You Just Nailed it , Ma'am

@JorgeRivera-rp1zw Год назад

Hi, Dear Rana . Many thanks to share your video with us..? Succeds..!

@acronproject Год назад

Thanks Ms.Khalil

@mrkewi1 Год назад

you're awesome. please don't stop

@sksalman6359 2 года назад

Thanks Rana Khalil 🥰🥰

@tomkatrio182 Год назад

so helpful thanks

@JuanBotes 2 года назад

thanks for making great content \o/

@kokn3t Год назад

Is it possible to exploit in "Authorization Bearer" JWT base web applications?

@sabuein 10 месяцев назад

Thank you.

@klalafudaklalafu 5 месяцев назад

How it possible for script from another tab (21:25) to access bank's tab's cookies to make requests on bank site?

@ram-gb4xg Год назад

Amazing!

@boobalandharani4848 Год назад

i need clarification . i changed the request header(CORS) origin url name( POST and GET method) and it get reflected in response. it will consider as defect or not .

@leonardofibonacci6574 11 месяцев назад

Good stuff here. What about JSONP for cross origin resource sharing? Is it a valid alternative to CORS? Are there security problems with JSONP?

@swamimzaman7058 2 года назад

Please make the other videos available 🙏

@jenks2897 2 года назад

What if I don't what to access or change any data just want to click a button on website A which then clicks or simulate a click on website B and execute a function, does this falls under CORS ? If not any suggestion on how this can be done?

@ArindamKashyap-qk1ps Год назад

Thanks a lot Rana. All my confusion are gone now. Thank you very much. Could you please make a video on Road to CEH Master, I'm thinking of taking the Elite package from EC council. I know you have cleared the OSCP and saw you video on David Bombal's channel. I got to know your videos from Portswigger's community solution. [ optional: you could make for the CEH Master one by collaborating with someone also].

@fathallahilyes529 7 месяцев назад

what mean access control allow origin header to null pls ?

@QuranKareem22 6 месяцев назад

thansk❤

@microsoft14. Год назад

God bless you 🙏

@AnujSharma-yv6gy 2 года назад

at 36:44, it is said that if there aren't any CORS headers being used by the application, it can be due to the application making use of dynamic generation. Later at 37:33, we check if the value in the origin header is being reflected in ACAO CORS header. So basically we're finding flaws in dynamic generation by making use of what's being reflected in CORS' ACAO header. Aren't both these statements contradictory? If there are no CORS headers and the reason is dynamic generation then how can we test for dynamic generation using CORS headers?

@AnujSharma-yv6gy 2 года назад

@Elijah Rodgers but since it isn't CORS header, wasn't it there anyways? We need ACAO header in response to test which is one of the two CORS headers.

@deepamsinha3933 3 месяца назад

I have one doubt regarding this.Suppose domain A wants domain B to access its resources, so it whitelists it. Another domain C knows that B is whitelisted. Now, domain C sends a request and specifies Origin equal to domain B, so will it be able to access the resources on A? If yes, then is it so easy to spoof origin and just access resources on a different domain?

@tiago7w_583 2 года назад

Top

@blackhatanonymous3687 2 года назад

why other videos are hidden of csrf? This is due to schedule or will be hidden for all time?

@ranjeetyaduvanshi6089 2 года назад

can you make some videos that match with industry requirements sometimes I'm get stuck in doing stuff well I'm Network Security Analyst i wants to learn more something new to add in my skilll

@hatemabushaala2487 6 месяцев назад

👏

@saurabhjha8733 5 месяцев назад

Ninja Hattori

@Ethical_Hacker216 7 месяцев назад

This vulnerability important ?! The issue you’ve described is related to Cross-Origin Resource Sharing (CORS) misconfiguration. CORS is a security feature implemented by web browsers to control which web domains can access resources on a given domain. In this case, the application has a CORS policy that allows access from any domain (Access-Control-Allow-Origin: *), which is considered overly permissive and poses a security risk.