https://cyberroute.github.io/tags/sop-bypass/ Recent content in Sop-Bypass on cyberroute Hugo -- gohugo.io en-us cyberroute@proton.me (Alessandro Bresciani) cyberroute@proton.me (Alessandro Bresciani) Tue, 14 Oct 2025 10:10:31 +0200 https://cyberroute.github.io/post/2025-10-14-cors/ Tue, 14 Oct 2025 10:10:31 +0200cyberroute@proton.me (Alessandro Bresciani) https://cyberroute.github.io/post/2025-10-14-cors/ Exploiting CORS Misconfigurations Introduction During a recent security assessment, I discovered a CORS (Cross-Origin Resource Sharing) misconfiguration that allowed complete bypass of the Same-Origin Policy. This vulnerability enabled an attacker to steal sensitive user information including API keys, email addresses, and session tokens from authenticated users. In this guide, I’ll walk you through the complete exploitation process using PortSwigger’s Web Security Academy lab as a practical example. Lab: CORS vulnerability with basic origin reflection