Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

[LABS] CORS vulnerability with trusted insecure protocols - is it possible with fetch() instead of AJAX?

Pawel | Last updated: Jul 24, 2022 11:35PM UTC

Hi, when trying with fetch, I get blocked by CORS. The script I try on the exploit server leads to the followin location: https://stock.my_lab_id.web-security-academy.net/?productId=1%3Cscript%3Efetch(%27https://my_lab_id.web-security-academy.net/accountDetails%27,{credentials:%20%22include%22}).then(res=%3Econsole.log(res))%3C/script%3E&storeId=1 Any ideas? Pawel

Hannah, PortSwigger Agent | Last updated: Jul 25, 2022 12:11PM UTC

Thanks for your query. Unfortunately, we are unable to provide personal support or tutoring to Academy users, as we prefer to improve the experience for our entire userbase by focusing on expanding and refining our public content. Your post will stay up on the forum for a member of the community to reply.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.