So the same Argin policy is a critical security mechanism to web applications.
And it restricts how a document or script is loaded from one Argin.
How we can interact with another origin makes sense.
So, in other words, it helps to isolate potentially malicious documents and reduces the a possible
attack vectors.
On the other hand, cross origin resource sharing is a relaxation of the same ARGIN policy implemented
in modern browsers.
And CNRS uses additional HTTP headers to tell browsers to give a web application running at one argin
access to selected resources from a different origin.
So I don't know.
I think we can say this mechanism supports secure across origin requests and data transfers between
browsers and servers.
And also, for security reasons, browsers restrict cross origin HTTP requests initiated from scripts.
So that means in this lesson, we are going to examine CRC features.
So after you log in to be WAP open cross origin resource sharing from the menu.
And it's a simple page, isn't it?
But here's a different scenario.
So there's a link on this page.
And based on the security level, we are going to try to read the content of the file that this link
points to.
So there are some cross origin obstacles to pass.
OK, so now let's start with the first level enable Foxe proxy.
Then we'll click on the secret link and the request will appear in berp.
Now, look at the first line of the request, it is secret cause one that BHP.
But it doesn't look like there's anything suspicious.
So forward it.
Now you can see the response message and it contains the secret of Neo.
But also look at the headers.
There is access control, allow Argin header with a value asterisk that means accept requests from all
origins.
That's why the secret court is one page except a request and shows a secret.
OK, so then forward that response to the browser.
All right, so now change the level of medium.
And we have a new superhero, Wolverine.
And we need his secret, but his secret is hidden behind this link, so click on the secret link.
And Berp has a request now.
And the first line is different from the previous request, huh?
But now we are requesting secret cause to page.
And there's nothing interesting here, so forward the request.
But it doesn't look like we can read the secret, it's just a plain response message.
So let it go.
OK, so there is a hint here on the page.
So the requested page can only accept requests from this origin.
OK, so before going any further, let's have a look at the code.
So this one is the main page.
And based on the security level, it redirects us to the superhero pages.
So scroll on down to the main part below.
And it just brings the values, nothing more.
So we can exit.
And view the cause one file.
And it just sets the header for all origins.
And Prince, the secret.
That's all.
So exit.
So what is inside caused to.
And it's not letting us read the secret, so it checks for a specific origin.
So if somehow we can add this Argin header to our request, we'll be able to read the secret for Wolverine.
So let's at this and view cause three.
And on this page, there are no headers and extra security checks.
So close that and go to Firefox's.
OK, now, quick, the secret again.
The request is in the proxy and I'm going to add the origin header.
You can add it anywhere except for the first line.
So this means the origin of my request is Internet, that it's easy Gamescom, so I'll go ahead and
forward it.
And that's perfect, we are able to get Wolverine Secre.
So let it go now.
A few seconds ago, we intercepted the request and added the origin had it right, but the developer
wants us to try with Ajax.
So open your terminals and I'll prepare an Ajax file.
You can download all the files and then after you download, move them to your Webroot directory and
Calli, because we're going to use them.
OK, so I need to go to Webroot directory.
And the files in this directory are just like that.
And I'm going to use the one that starts with cause, so just type them cause dot p.
All right, so this is a simple file, it just includes the script.
OK, so exit and view the JavaScript, file them caused by James.
And the script makes an Ajax call to the secret cause to be.
It adds an Argin header.
OK, go back.
Open a new tab and request caused that file in Kelly.
OK, so it's an berp now.
Forward it.
In the page loads and look at the script tags, they're calling for the Ajax file.
OK, good.
So forward it.
And now the Ajax code is uploaded to the browser.
And then send a request to secret cause to P.
By adding the header.
And see, this is why we want.
But there's a problem.
The origin had her value is now the same as in the code.
Well, you know what?
Just forward it anyway.
And that's really no secret.
So to figure out what's just happened, let's open up the web developer tool, go to the console tab.
Let's have a look at the warnings, because changing the origin header with Ajax in the browser is forbidden,
so it points to the line.
So the same Arjan policy refuses to read the secret cause to file.
So what do you think?
I think these warnings explain everything quite well, so that means we need to find another solution.
So what I like to do in these situations is use my good old friend, Colonel.
You know, Colonel.
You can always try a different way.
OK, then go back.
Kearl is also implemented in BHP.
So I'm going to show you, cause one BHP and this is the Kerl code.
And it will request the same page and show the response to us, and of course, it's going to add the
Argin header.
So in this case, we are going to request this page.
And then in the background, Curl will request the secret cause to up page.
OK, so go back to Firefox's.
Open a new tab and go to cause one dot BHP.
And there's nothing here in this request.
So his forward.
Yeah, congratulations, we programmatically read Wolverine's secret.
All right.
We didn't even see what happens, thankfully, Kearl did everything for us.