Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

[LABS] CORS vulnerability with trusted insecure protocols - is it possible with fetch() instead of AJAX?

Pawel | Last updated: Jul 24, 2022 11:35PM UTC

Hi, when trying with fetch, I get blocked by CORS. The script I try on the exploit server leads to the followin location: https://stock.my_lab_id.web-security-academy.net/?productId=1%3Cscript%3Efetch(%27https://my_lab_id.web-security-academy.net/accountDetails%27,{credentials:%20%22include%22}).then(res=%3Econsole.log(res))%3C/script%3E&storeId=1 Any ideas? Pawel

Hannah, PortSwigger Agent | Last updated: Jul 25, 2022 12:11PM UTC