Work in progress ...
POST /setting/ HTTP/1.1
Host: www.example.com
password=azerty&token=x
------------------------
HTTP/1.1 403 Forbidden
GET /setting/?password=azerty&token=x
Host: www.example.com
------------------------
HTTP/1.1 200 OK
GET /setting/?password=azerty
Host: www.example.com
- XSS
- CORS Misconfiguration
- JSON Hijacking
- Information disclosure
https://vuln.co
https://attacker.com?https://vuln.com/
https://vuln.com.attacker.com/
https://attackervuln.com/
https://[email protected]//
GET /?redirect=https://example.com/setting/?password=azerty
Host: www.example.com
Referer: https://www.example.com/