PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bypassing browser tracking protection for CORS misconfiguration abuse

swarm.ptsecurity.com | research | #browser-security | #web-security | #cors | #same-origin-policy | #tracking-protection
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

PT SWARM shows CORS misconfigurations — reflected Origin plus credentials — can still leak sensitive data despite tracking protection, by bypassing the block on third-party requests.
Published
Collected

Related coverage

blog · aikido.dev
CORS Security: Beyond Basic Configuration
A deep dive into CORS beyond quick fixes: how it evolved from the Same-Origin Policy, how browsers and servers negotiate preflights and credentials, and why setups that look right still fail.
research · swarm.ptsecurity.com
Getting XXE in Web Browsers using ChatGPT
Can a JavaScript-less page read local files? ChatGPT-generated samples expose browser XSL/XML vectors — XSLT, XInclude and document() — that reach file:// content despite the SOP.
research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
CSS:the bomb inside your inbox
PortSwigger breaks webmail CSS sanitizers to cross trust boundaries, exfiltrate tokens, control AI browsers by email and steal passwords, with attacks spanning Yahoo, Fastmail, ProtonMail and Gmail.
research · portswigger.net
Introducing the URL validation bypass cheat sheet
PortSwigger launches the URL Validation Bypass Cheat Sheet, consolidating payloads for SSRF, CORS misconfiguration and open redirect testing, with three contexts and Intruder-friendly wordlists.
research · portswigger.net
Using Hackability to uncover a Chrome infoleak
Using his Hackability Inspector, Gareth Heyes found a Chrome infoleak: setting a cross-domain iframe to about:blank exposed baseURI, leaking full URLs and enabling OAuth token theft across subdomains.
Back