cors漏洞 复现_CORS的进阶利用

简介

主要看了Corben Leo的Advanced CORS Exploitation Techniques这篇文章，对这篇文章的一个翻译吧,收获良多，复现一下cors漏洞的进阶利用。直入正题。

CORS介绍

这里就借OWASP的关于CORS的介绍。

CORS stands for Cross- Origin Resource Sharing.
Is an feature offering the possbility to:

• A web application to expose resources to all or restricted domain,
• A web client to made AJAX request for resource on other domain than is source domain.

This article will focus on HTTP Request Preflight feature proposed by CORS W3C specification and (mainly) how to setup a protection, on web application side, against CORS HTTP request that try to bypass the preflight process. 简单的来说，它是为了跨域资源共享，web开发者可以通过发送AJAX请求不同域下的资源。关于CORS的利用可以参考这篇文章《cors安全完全指南》。

复现环境准备

• 靶机环境
  • nginx/1.16.0
  • PHP 5.6.40
• 攻击机环境
  • Node/v10.9.0

受害者环境配置

受害者服务器配置CORS策略，在nginx.conf server下增加以下配置(当然你也可以直接在代码中设置)：

location / {
 add_header Access-Control-Allow-Origin $http_origin;
 add_header Access-Control-Allow-Methods GET,POST,OPTIONS;
 add_header Access-Control-Allow-Credentials true;
 if ($request_m