RFD: Reflected File Download

In today's episode of "from 0 to pentesting hero" about Reflected File Download.
Subscribe: www.youtube.co...
This type of vulnerability usually occurs in jsonp endpoints.
Suppose we have an API that returns the current time.
We want to download this data using JavaScript.
If the API is within the current domain, everything is fine.
The problem arises, however, if this API belongs to an external service.
By default, the browsers do not allow to send an ajax request to another domain.
The protection here is the Same Origin Policy.
One solution to this problem is jsonp.
The workaround uses the fact that unless you can send ajax requests to an external domain, you can use the script tag to load external JavaScript code.
A lot of websites work this way - when various libraries are hosted on external servers of service providers - that is CDNs.
However, we can't load the file in json format - because it will not be recognized by the browser as a valid JavaScript code.
But if the contents of the json file are wrapped in a function call - the JavaScript interpreter will understand this as the instructions for executing a given function and json will be passed there as a parameter.
Twitter: / kacperszurek
Website: security.szure...
Github: github.com/kac...
Icon made by Freepik, Smashicons from www.flaticon.com
#from0topentestinghero #security #download

[@vintprox]

Omg, so-so many vulnerabilities! 😲 Thank you for making these videos! 🤗

[@carlosneri1152]

a href download atibute "filename" doesn't seens to work on cross origin, due to the current same origin policy.

[@PwnFunction]

Good stuff as usual!

[@prashantpandey645]

🥳🥳🥳