Same-Origin Policy Vulnerabilities

The Same-Origin Policy (SOP) restricts how a script originating from one site can interact with the resources of a different site, and it's crucial in preventing many common web vulnerabilities. But websites often loosen SOP in order to have more flexibility. These controlled and intended SOP bypasses can have adverse effects, as attackers can sometimes exploit misconfigurations in these techniques to bypass the SOP.

Hunt for SOPs

1. Find out if the application uses any SOP relaxation techniques. Is the application using CORS, postMessage, or JSONP?
2. If the site is using CORS, test the strength of the CORS allowlist by submitting test Origin headers.
3. If the site is using postMessage, see if you can send or receive messages as an untrusted site.
4. If the site is using JSONP, try to embed a script tag on your site and request the sensitive data wrapped in the JSONP payload.
5. Determine the sensitivity of the information you can steal using the vulnerability, and see if you can do something more.