Skip to content

Instantly share code, notes, and snippets.

@ejcx

ejcx/trickery.sh

Last active April 27, 2019 06:52
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ejcx/697b346dbbb3225d14e4 to your computer and use it in GitHub Desktop.
Save ejcx/697b346dbbb3225d14e4 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
trickery.sh
root@ejjio:/var/www/misconfigured-cors# curl -H "Origin: https://ejj.io.evil.com" https://ejj.io -I
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Wed, 24 Feb 2016 06:47:21 GMT
Content-Type: text/html
Set-Cookie: PHPSESSID=sd7ejaf2lufukhq7se49lmsg76; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Origin: https://ejj.io.evil.com
Access-Control-Allow-Credentials: true
Vary: Accept-Encoding
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment