Question

Go ahead and start looking for your first SOP bypass. To find SOP-bypass vulnerabilities, you will need to understand the SOP relaxation techniques the target is using. You may also want to become familiar with JavaScript in order to craft effective POCs.

请开始寻找您的第一个 SOP 绕过。要发现 SOP 绕过漏洞，您需要了解目标使用的 SOP 放宽技术。您可能还需要熟悉 JavaScript，以制作有效的 POC。

1. Find out if the application uses any SOP relaxation techniques. Is the application using CORS, postMessage , or JSONP?
2. If the site is using CORS, test the strength of the CORS allowlist by submitting test Origin headers.
3. If the site is using postMessage , see if you can send or receive messages as an untrusted site.
4. If the site is using JSONP, try to embed a script tag on your site and request the sensitive data wrapped in the JSONP payload.
5. Determine the sensitivity of the information you can steal using the vulnerability, and see if you can do something more.
6. Submit your bug report to the program!