0

I’m currently researching a possible security vulnerability I may have found on a well-known website. Before I present to the company, I’d like to build a proof of concept.

I’m looking at a site (Site A) that has a form. The user picks a location from a list and then enters a number between 1 and 10. The form then returns some information and a price.

I’d like to build a form on a different site (Site B) which replicates the steps and extracts the data from Site A.

I’m pretty certain that this isn’t possible without API access or CORS being configured. Is that right or could you build a bot to do the data scraping from Site A to B?

0

I think you are confused.

I’d like to build a form on a different site (Site B) which replicates the steps and extracts the data from Site A.

That won't be possible because the same origin policy would restrict that. But the vulnerability you talked about has nothing to do with CORS. In fact, there is no security vulnerability to begin with.

I’m pretty certain that this isn’t possible without API access or CORS being configured. Is that right or could you build a bot to do the data scraping from Site A to B?

You could build a bot to scrape data from A but there is no need to scrape that data from site B. If you want to scrape data, that is possible and only requires programming. I still don't see any vulnerability, if there is, please tell me in comments or edit the question

  • Thanks for coming back to me. The form on Site A doesn't have any bot protection and displays confidential information when it's submitted. I just want to know if it's possible to extract this information into the form on Site B. As you say, CORS prevents this, so I think I can build a bot to extract the information from Site A. Is that right? – Sam Sep 1 '19 at 17:44
  • CORS doesnt prevent it Same origin policy does CORS is a way to relax SOP.Unless you have CORS misconfiguration on vulnerable site you cant get the http response in attacker site.But a bot(scraper) is still possible and can be done via python.But there is no vulerability here just a bruteforce of data – Vipul Nair Sep 1 '19 at 17:48
  • Thank you for the clarification. The vulnerability I'm speaking about is quite complex and involves some social engineering. The form is a small part of the problem. Thank you for your help. – Sam Sep 1 '19 at 17:50
0

If I understand correctly you want to demonstrate this to the company, but not directly on their site. You could copy the HTML they use onto site B, and during submission, on the server side send the POSTed data to siteA, then scrape the response to show the data that's relevant. CORS is applicable for JavaScript and shouldn't be necessary, although of course without details on the PoC I can't say definitively.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.