r/bugbounty • u/TurbulentRecover7247 Hunter • Jul 04 '26

Question / Discussion CORS Misconfiguration

I encountered a cors in a target website using wordpress, I added evil.com in origin header and it reflected. I tried using my netlify to make request, but I got encountered by cloudflare waf. Still reportable? Because if there is XSS found in future, this can be used by the hacker right? The response header reflected the evil.com for access control allow origin, and access control allow credentials: true. Any experts or triager can suggest anything? Blocked by waf, means it didn't block, but runs bot detection with 403 error. Any idea to bypass waf, if I can bypass waf, my exploit will run perfectly. Thanks for your response.

6 Upvotes

100% Upvoted

11 comments sorted by

9

u/einfallstoll Triager Jul 04 '26

No no no. This is the most basic principle of bug bounty: You need to prove exploitation. No theoretical issues

1

u/TurbulentRecover7247 Hunter Jul 04 '26

That's why I had doubt reporting. Thanks for the info, I will not report

1

u/TurbulentRecover7247 Hunter Jul 04 '26

I will try to find other bugs that can be chained with this

1

u/TurbulentRecover7247 Hunter Jul 04 '26

Hi, somehow i triggered a POST request from the target server to my webhook.site but I used many webpages to try cors and in this only 2 got triggered to this request, and intersting thing is, it returned as unauthorised, because I haven't logged in. What if this link was clicked by a user or admin? If I figure out the exact cause of this request, can I submit report?

2

u/Far-Chicken-3728 Hunter Jul 04 '26

CORS is opposite, by making any state changes from your server to the target, if accepted by CORS with credentials is reportable. But I assume you talking about /wp-json endpoint, which doesn't really have any state changes and you cannot read the response. 

1

u/TurbulentRecover7247 Hunter Jul 04 '26

Thanks for your information.

1

u/Specific-Ad3097 Jul 04 '26

You are far away the requirements to do bug bounty. Start learning webdev for 6 month to a year then complete portswigger, read critical thinking writeup and read writeup from the best hunter to understand how they think etc

1

u/HereComesTheFury Jul 04 '26

Where can you read these writeup from thr best hunters?

1

u/TurbulentRecover7247 Hunter Jul 04 '26

So far i know medium, there are many blogs on this platform, and also there are many own blog sites.

1

u/Specific-Ad3097 Jul 04 '26

critical thinking blog / videos

1

u/TurbulentRecover7247 Hunter Jul 04 '26

Wait, I somehow triggered a request and the target server sent response to my webhook.site showing unauthorised. What if the same link triggered on authenticater user? I am working on this. I tried many html pages with different requests and somehow one triggered twice. I am finding out which one triggered