I have made a script that can be used for exploiting CORS misconfiguration.
The script works fine but if I want to send an extra header to the request by
It first sends the pre-flight(OPTIONS) request that contains
which the server denies and cancels further requests.
Problem Scenario: Suppose there is one header "test_header" which is allowed by the server
Now sending the same header via CORS script:
Sends a pre-flight request with
HTTP/1.1 200 OK Content-Length: 0 Date: Wed, 27 Nov 2019 18:19:29 GMT Connection: close
No more then this
So is it possible to add this header in the request without sending options request?
Can the request be proxied somewhere which then adds the header to the server?
Is there a way to send a header to the server from the victim's computer which then validates the header and sends the response?