‫So the same Argin policy is a critical security mechanism to web applications.
‫And it restricts how a document or script is loaded from one Argin.
‫How we can interact with another origin makes sense.
‫So, in other words, it helps to isolate potentially malicious documents and reduces the a possible
‫attack vectors.
‫On the other hand, cross origin resource sharing is a relaxation of the same ARGIN policy implemented
‫in modern browsers.
‫And CNRS uses additional HTTP headers to tell browsers to give a web application running at one argin
‫access to selected resources from a different origin.
‫So I don't know.
‫I think we can say this mechanism supports secure across origin requests and data transfers between
‫browsers and servers.
‫And also, for security reasons, browsers restrict cross origin HTTP requests initiated from scripts.
‫So that means in this lesson, we are going to examine CRC features.
‫So after you log in to be WAP open cross origin resource sharing from the menu.
‫And it's a simple page, isn't it?
‫But here's a different scenario.
‫So there's a link on this page.
‫And based on the security level, we are going to try to read the content of the file that this link
‫points to.
‫So there are some cross origin obstacles to pass.
‫OK, so now let's start with the first level enable Foxe proxy.
‫Then we'll click on the secret link and the request will appear in berp.
‫Now, look at the first line of the request, it is secret cause one that BHP.
‫But it doesn't look like there's anything suspicious.
‫So forward it.
‫Now you can see the response message and it contains the secret of Neo.
‫But also look at the headers.
‫There is access control, allow Argin header with a value asterisk that means accept requests from all
‫origins.
‫That's why the secret court is one page except a request and shows a secret.
‫OK, so then forward that response to the browser.
‫All right, so now change the level of medium.
‫And we have a new superhero, Wolverine.
‫And we need his secret, but his secret is hidden behind this link, so click on the secret link.
‫And Berp has a request now.
‫And the first line is different from the previous request, huh?
‫But now we are requesting secret cause to page.
‫And there's nothing interesting here, so forward the request.
‫But it doesn't look like we can read the secret, it's just a plain response message.
‫So let it go.
‫OK, so there is a hint here on the page.
‫So the requested page can only accept requests from this origin.
‫OK, so before going any further, let's have a look at the code.
‫So this one is the main page.
‫And based on the security level, it redirects us to the superhero pages.
‫So scroll on down to the main part below.
‫And it just brings the values, nothing more.
‫So we can exit.
‫And view the cause one file.
‫And it just sets the header for all origins.
‫And Prince, the secret.
‫That's all.
‫So exit.
‫So what is inside caused to.
‫And it's not letting us read the secret, so it checks for a specific origin.
‫So if somehow we can add this Argin header to our request, we'll be able to read the secret for Wolverine.
‫So let's at this and view cause three.
‫And on this page, there are no headers and extra security checks.
‫So close that and go to Firefox's.
‫OK, now, quick, the secret again.
‫The request is in the proxy and I'm going to add the origin header.
‫You can add it anywhere except for the first line.
‫So this means the origin of my request is Internet, that it's easy Gamescom, so I'll go ahead and
‫forward it.
‫And that's perfect, we are able to get Wolverine Secre.
‫So let it go now.
‫A few seconds ago, we intercepted the request and added the origin had it right, but the developer
‫wants us to try with Ajax.
‫So open your terminals and I'll prepare an Ajax file.
‫You can download all the files and then after you download, move them to your Webroot directory and
‫Calli, because we're going to use them.
‫OK, so I need to go to Webroot directory.
‫And the files in this directory are just like that.
‫And I'm going to use the one that starts with cause, so just type them cause dot p.
‫All right, so this is a simple file, it just includes the script.
‫OK, so exit and view the JavaScript, file them caused by James.
‫And the script makes an Ajax call to the secret cause to be.
‫It adds an Argin header.
‫OK, go back.
‫Open a new tab and request caused that file in Kelly.
‫OK, so it's an berp now.
‫Forward it.
‫In the page loads and look at the script tags, they're calling for the Ajax file.
‫OK, good.
‫So forward it.
‫And now the Ajax code is uploaded to the browser.
‫And then send a request to secret cause to P.
‫By adding the header.
‫And see, this is why we want.
‫But there's a problem.
‫The origin had her value is now the same as in the code.
‫Well, you know what?
‫Just forward it anyway.
‫And that's really no secret.
‫So to figure out what's just happened, let's open up the web developer tool, go to the console tab.
‫Let's have a look at the warnings, because changing the origin header with Ajax in the browser is forbidden,
‫so it points to the line.
‫So the same Arjan policy refuses to read the secret cause to file.
‫So what do you think?
‫I think these warnings explain everything quite well, so that means we need to find another solution.
‫So what I like to do in these situations is use my good old friend, Colonel.
‫You know, Colonel.
‫You can always try a different way.
‫OK, then go back.
‫Kearl is also implemented in BHP.
‫So I'm going to show you, cause one BHP and this is the Kerl code.
‫And it will request the same page and show the response to us, and of course, it's going to add the
‫Argin header.
‫So in this case, we are going to request this page.
‫And then in the background, Curl will request the secret cause to up page.
‫OK, so go back to Firefox's.
‫Open a new tab and go to cause one dot BHP.
‫And there's nothing here in this request.
‫So his forward.
‫Yeah, congratulations, we programmatically read Wolverine's secret.
‫All right.
‫We didn't even see what happens, thankfully, Kearl did everything for us.