‫So the same origin policy is a critical security mechanism to Web applications.
‫And it restricts how a document or script is loaded from one origin.
‫How we can interact with another origin makes sense.
‫So in other words, it helps to isolate potentially malicious documents and reduces the possible attack
‫vectors.
‫On the other hand, cross origin resource sharing is a relaxation of the same origin policy implemented
‫in modern browsers, and series uses additional HTTP headers to tell browsers to give a web application
‫running at one origin access to selected resources from a different origin.
‫So I don't know.
‫I think we can say this mechanism supports secure across origin request and data transfers between browsers
‫and servers.
‫And also, for security reasons, browsers restrict cross origin HTTP requests initiated from scripts.
‫So that means in this lesson, we are going to examine CRC features.
‫So after you log in to be Web open cross origin resource sharing from the menu.
‫And it's a simple page, isn't it?
‫But here's a different scenario.
‫So there's a link on this page.
‫And based on the security level, we are going to try to read the content of the file that this link
‫points to.
‫So there are some cross origin obstacles to pass.
‫OK, so now let's start with the first level enable foxy proxy.
‫Then we'll click on the secret link and the request will appear in Burp.
‫Now, look at the first line of the request.
‫It is secret, cause one that.
‫But it doesn't look like there's anything suspicious.
‫So forward it.
‫Now you can see the response message, and it contains this secret of Neo.
‫But also look at the headers.
‫There is access control allow margin header with a value asterisk that means accept requests from all
‫origins.
‫That's why the secret court is one page, except our request and shows the secret.
‫OK, so then forward that response to the browser.
‫All right, so now change the level of medium.
‫And we have a new superhero.
‫Wolverine.
‫And we need his secret, but his secret is hidden behind this link.
‫So click on the secret link.
‫And Burp has a request now.
‫And the first line is different from the previous request, huh?
‫But now we are requesting secret corners to page.
‫And there's nothing interesting here.
‫So for were the request.
‫But doesn't look like we can read the secret.
‫It's just a plain response message.
‫So let it go.
‫OK, so there is a hint here on the page.
‫So the requested page can only accept a request from this origin.
‫OK, so before going any further, let's have a look at the code.
‫So this one is the main page.
‫And based on the security level, it redirects us to the superhero pages.
‫So scroll on down to the main part below.
‫And it just brings the values nothing more.
‫So we can exit.
‫And view the as one file.
‫And it just sets the header for all origins.
‫And Prince, the secret.
‫And so on.
‫So exit.
‫So what is inside course to?
‫And it's not letting us read the secret, so it checks for a specific origin.
‫So if somehow we can add this origin header to our request, we'll be able to read the secret for Wolverine.
‫So let's accept this and view cause three.
‫And on this page, there are no headers and extra security checks.
‫So close that and go to Firefox.
‫OK, now quick, the secret again.
‫The request is in the proxy, and I'm going to add the origin header.
‫You can add it anywhere, except for the first line.
‫So this means the origin of my request is internet that it's easy Gamescom.
‫So go ahead and forward it.
‫And that's perfect.
‫We are able to get Wolverine Secre.
‫So let it go now.
‫A few seconds ago, we intercepted the request and added the urgent header, right?
‫But the developer wants us to try with Ajax, so open your terminals and I'll prepare an Ajax file.
‫You can download all the files and then after you download, move them to your web root directory and
‫Kelly because we're going to use them.
‫OK, so I need to go to Weber directory.
‫And the files in this directory are just like that.
‫And I'm going to use the one that starts with cause.
‫So just type them cause dot p.
‫All right, so this is a simple file.
‫It just includes the Ajax script.
‫OK, so exit and view the JavaScript, file them caused Dot, yes.
‫And the script makes an Ajax call to the secret cause to not be.
‫It adds an origin header.
‫OK, go back.
‫Open up a new tab and request caused a profile in Cowley.
‫OK, so it's in burp now.
‫Forward it.
‫And the page loads and look at the script tags, they're calling for the Ajax fire.
‫OK, good.
‫So forward it.
‫And now the Ajax code is uploaded to the browser.
‫And then send a request to secret cause to keep.
‫By adding the origin header.
‫And see, this is why we want.
‫But there's a problem.
‫The origin header value is not the same as in the code.
‫Well, you know what, just forward it anyway.
‫And that's really no secret.
‫So to figure out what's just happened to open up the Web developer tool, go to the console tab.
‫Let's have a look at the warnings because changing the origin header with Ajax in the browser is forbidden,
‫so it points to the line.
‫So the same margin policy refuses to read the secret court to top up file.
‫So what do you think, I think these warnings explain everything quite well.
‫So that means we need to find another solution.
‫So what I like to do in these situations is use my good old friend Curl.
‫Do you know, Colonel?
‫You can always try a different way.
‫OK, and then go back.
‫Curlers also implemented in BHP.
‫So I'm going to show you cause one dot BHP.
‫And this is the HP Curl Code.
‫And it will request the same page and show the response to us.
‫And of course, it's going to add the origin header.
‫So in this case, we are going to request this page.
‫And then in the background, Curl will request the secret wars to add up HP page.
‫OK, so go back to Firefox.
‫Open a new tab and go to corners one dot BHP.
‫And there's nothing here in this request.
‫So just forward.
‫Yeah, congratulations.
‫We programmatically read Wolverine's secret.
‫All right.
‫We didn't even see what happens.
‫Thankfully, Curl did everything for us.