OSWA · Module 6
Cross-Origin Attacks
Exploit CORS misconfigurations, cross-site request forgery, and clickjacking that abuse cross-origin trust and the victim's session.
~2 h 5 resources Last updated September 26, 2026
Cross-origin attacks abuse the trust between a victim's authenticated session and a malicious page they visit. CORS misconfigurations let an attacker's origin read responses that should be private. Cross-site request forgery (CSRF) tricks an authenticated user's browser into sending state-changing requests without their knowledge. Clickjacking layers an invisible frame over bait content to steal clicks. All three exploit the browser's willingness to send credentials cross-origin, and all three are in scope for a web assessment.
CORS Misconfiguration
The Same-Origin Policy blocks cross-origin reads by default, but a misconfigured Access-Control-Allow-Origin header reopens that door. Testing means probing how the server reflects the Origin header: does it echo an arbitrary origin, accept null, trust any subdomain, or use a weak regex? When credentials are allowed alongside a reflected origin, an attacker page can read authenticated responses and exfiltrate sensitive data.
CSRF and Clickjacking
CSRF discovery is about finding state-changing requests that rely only on the session cookie, with no anti-CSRF token or with a token that is not properly validated. Exploitation delivers an auto-submitting form or crafted request from an attacker page, with techniques for JSON bodies, multipart forms, token bypasses, and SameSite cookie windows. Clickjacking abuses missing frame protections to overlay a transparent frame and harvest clicks, including multi-step and pre-filled-form variants.
Read
The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.
Practice
Apply the module hands-on.
- Basic clickjacking with CSRF token protection PortSwigger Apprentice
- CORS vulnerability with basic origin reflection PortSwigger Apprentice
- CORS vulnerability with trusted null origin PortSwigger Apprentice
- CSRF vulnerability with no defenses PortSwigger Apprentice
- CORS vulnerability with trusted insecure protocols PortSwigger Practitioner
- CSRF where Referer validation depends on header being present PortSwigger Practitioner
- CSRF where token is not tied to user session PortSwigger Practitioner
- CSRF where token validation depends on request method PortSwigger Practitioner
- Exploiting clickjacking vulnerability to trigger DOM-based XSS PortSwigger Practitioner
- SameSite Lax bypass via method override PortSwigger Practitioner
- SameSite Strict bypass via client-side redirect PortSwigger Practitioner
- CSRF TryHackMe Easy