Skip to content

Instantly share code, notes, and snippets.

@ejcx

ejcx/cors-scanner.sh

Last active July 15, 2020 08:20
Show Gist options
  • Star 4 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save ejcx/ecb1ae956c399336d1bd to your computer and use it in GitHub Desktop.
Save ejcx/ecb1ae956c399336d1bd to your computer and use it in GitHub Desktop.
Download ZIP
Raw
cors-scanner.sh
#!/bin/sh
while read -r domain
do
# Remember. Account for the fact that some sites don't exist on HTTP
# And others don't exist on HTTPS. Prune later.
curl -I "https://$domain" --max-time 3 -H "Origin: https://$domain.evil.com" | ./respirator&
curl -I "http://$domain" --max-time 3 -H "Origin: http://$domain.evil.com" | ./respirator&
done < "top1mdomains"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment