I need to crate a PoC in order to exploit a CORS mis-configuration. I'have discovered that the vulnerable server implements a poor whitelist policy that checks if substrings are in the whitelist. So in theory this can be exploited given a proper Origin header. In practice I used BURP to set the header and it worked.

The trouble is that the PoC should be embedded in a HTML page and in particular I can't intercept request and modify them.

I've discover that "setRequestHeader("Origin", 'example.com')" is not allowed in most browsers.

Any help would be welcomed!

2 Answers 2


You cannot explicitly set the Origin or Referer from inside the browser. If you want to have a specific substring in the Origin you need to make sure that the victim is accessing a domain containing this Origin and then you can embed the attack there.

For example, if the string example.com is allowed by the server (like any requests from a domain with this substring are answered with an Access-Control-Allow-Origin: *) then you can setup your a domain example.com.your-own-domain.foo, embed the attack in a page on this domain and make sure that the user visits this domain (for example by having a link in the mail, embedding it in a post in some forum, serving advertisements ...).


If you just want to test this locally without buying domains, you could just set a domain in your hosts file to point to localhost - hosting your POC exploit page.

For example if the CORS is allowing the substring 'example', you could just set example.test to point to you local test server. it might also be possible to create a example.github.io page where you can serve content from github or a similar site.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .