Challenge 40 of 66

Cross Origin

🟠 Hard Web App +100 XP

An API returns Access-Control-Allow-Origin: * with credentials. Steal the admin token from a cross-origin page.

Cross Origin // sandbox

CORS with wildcard + credentials = any site can read the response.

Know someone who would enjoy this? Challenge them.

Keep going

Make it count. Join free to earn XP for what you read and solve, keep a streak, and track your progress.