A private JSON API
The account API at /api/account returns your details as JSON:
curl -s http://127.0.0.1:8080/api/accountIn the terminal
student@vulntech:~$ curl -s http://127.0.0.1:8080/api/account {"username": "you", "balance": "4,210 credits", "secret": "vulntech{cors_trusts_any_origin}"}
Normally the browser's same-origin policy stops evil.com from reading that response, even if it can send the request. CORS is how a server deliberately says “this other origin is allowed to read me” — and getting that wrong hands your data to everyone.