I am doing some research for my college project and I want to ask is there any other way through which an attacker can obtain data from HTTP response except MITM and CORS attack. For an example, If I send HTTP request to the website and in return, they send me some sensitive data. By which technique can attacker can obtain these sensitive data except MITM attack and CORS attack.

  • An insecure usage of the postMessage API can lead to cross-origin data leakage on the client side.
    – jub0bs
    Sep 9 '21 at 14:57

... except MITM and CORS attack

I'm not sure what CORS attack you refer to but my guess is you mean attacks possible by an overly broad (permissive) CORS setup.

Apart from these the attacker might get access to the HTTP response if he can execute code at the client with the Origin of the target domain (or whatever CORS allows additionally). This can be done for example through XSS (cross-site scripting) but also by compromising any server from which the client includes script into the original page (like advertisement or tracking server) and modifying the script served by this server.

And then there are WebSockets which don't have any same-origin policy. Unless the WebSocket server of the specific domain explicitly and properly checks the Origin an attacker could simply create a WebSocket connection to the specific domain within a JavaScript on his own site, make the victim visit the site and then can communicate with the WebSocket server with the existing authentication information (like session cookie) of the client - see Cross-Site WebSocket Hijacking (CSWSH).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.