I have made a script that can be used for exploiting CORS misconfiguration.
The script works fine but if I want to send an extra header to the request by
xhttp.setRequestHeader("test_header", "test_value")
It first sends the pre-flight(OPTIONS) request that contains
Access-Control-Request-Headers: header_name
which the server denies and cancels further requests.
Problem Scenario: Suppose there is one header "test_header" which is allowed by the server
Original request:
sending "test_header
"
Original response:
Access-Control-Allow-Headers: test_header
Success
Now sending the same header via CORS script:
xhttp.setRequestHeader("test_header", "test_value")
Sends a pre-flight request with Access-Control-Request-Headers: test_header
.
response:
HTTP/1.1 200 OK
Content-Length: 0
Date: Wed, 27 Nov 2019 18:19:29 GMT
Connection: close
No more then this
So is it possible to add this header in the request without sending options request?
Can the request be proxied somewhere which then adds the header to the server?
Is there a way to send a header to the server from the victim's computer which then validates the header and sends the response?