# Cross-Origin Attacks

> Exploit CORS misconfigurations, cross-site request forgery, and clickjacking that abuse cross-origin trust and the victim's session.

- **URL:** https://hackindex.io/learn/oswa-web-200-study-path/cross-origin-attacks
- **Certification:** [OSWA (WEB-200) Study Path](https://hackindex.io/learn/oswa-web-200-study-path.md)
- **Estimated study hours:** 2
- **Published:** 2026-09-26
- **Updated:** 2026-09-26

Cross-origin attacks abuse the trust between a victim's authenticated session and a malicious page they visit. CORS misconfigurations let an attacker's origin read responses that should be private. Cross-site request forgery (CSRF) tricks an authenticated user's browser into sending state-changing requests without their knowledge. Clickjacking layers an invisible frame over bait content to steal clicks. All three exploit the browser's willingness to send credentials cross-origin, and all three are in scope for a web assessment.

## CORS Misconfiguration

The Same-Origin Policy blocks cross-origin reads by default, but a misconfigured Access-Control-Allow-Origin header reopens that door. Testing means probing how the server reflects the Origin header: does it echo an arbitrary origin, accept null, trust any subdomain, or use a weak regex? When credentials are allowed alongside a reflected origin, an attacker page can read authenticated responses and exfiltrate sensitive data.

## CSRF and Clickjacking

CSRF discovery is about finding state-changing requests that rely only on the session cookie, with no anti-CSRF token or with a token that is not properly validated. Exploitation delivers an auto-submitting form or crafted request from an attacker page, with techniques for JSON bodies, multipart forms, token bypasses, and SameSite cookie windows. Clickjacking abuses missing frame protections to overlay a transparent frame and harvest clicks, including multi-step and pre-filled-form variants.

## Study material

- [CORS Misconfiguration Testing](https://hackindex.io/services/web/vulnerability-discovery/cors-misconfiguration.md) (read, core)
- [CORS Exploitation](https://hackindex.io/services/web/exploitation/cors-exploitation.md) (read, core)
- [CSRF Detection](https://hackindex.io/services/web/vulnerability-discovery/csrf-detection.md) (read, core)
- [CSRF Exploitation](https://hackindex.io/services/web/exploitation/csrf-exploitation.md) (read, core)
- [Clickjacking](https://hackindex.io/services/web/exploitation/clickjacking.md) (read, core)