Task 1 - Introduction
Q1. Deploy the target VM attached to this task by pressing the green Start Machine button. We will use the machine's generated IP address later at the end of the room.
No Answer Needed
Task 2 - Understanding SOP
Q1. What policy instructs web browsers how they should interact between web pages?
Learn more about Same Origin Policy - SOP
Answer š Same-origin Policy
Task 3 - Understanding CORS
Q1. What HTTP header specifies which domains are allowed to access the resources hosted in its server?
Learn more about Cross-Origin-Resource-Sharing (CORS)
Answer š Access-Control-Allow-Origin
Task 4 - ACAO in depth
Q1. What origin configuration permits requests from any origin, is the least secure configuration, and should be used cautiously?
Answer š Wildcard Origin
Task 5 - Common Misconfigurations
Q1. What CORS misconfiguration occurs when a server accepts requests from the "null" origin?
Answer š Null Origin Misconfiguration
Task 6 - Lab Connection
Q1. I've modified my hosts file.
No Answer Needed
Task 7 - Arbitrary Origin
Q1. What is the flag from arbitrary.php?
No Answer Needed
Task 8 - Bad Regex in Origin
Q1. What is the flag from badregex.php?
No Answer Needed
Task 9 - Null Origin
Q1. What is the flag from null.php?
No Answer Needed
Task 10 - Conclusion
Q1. I can now exploit CORS and SOP-related vulnerabilities!
No Answer Needed