LuD1161 · June 28, 2018 19:32
diff --git a/CORS-and-Clickjacking-Test.html b/CORS-and-Clickjacking-Test.html
 <!DOCTYPE html>
 <html>
 <head>
    <meta charset="utf-8"/>
    <title>CORS and Clickjacking checker</title>
    <style>
            body {
                font-family: Arial;
                color: white;
            }   
            .split {
                height: 100%;
                width: 50%;
                position: fixed;
                z-index: 1;
                top: 0;
                overflow-x: hidden;
                padding-top: 20px;
            }
            
            .left {
                left: 0;
                background-color: rgb(63, 196, 226);
            }
            
            .right {
                right: 0;
                background-color: #77ae50;
            }
    </style>

 <script>
 function get_urls(id_txtarea){
    txtarea = document.getElementById(id_txtarea);
    urls = txtarea.value.split('\n');
    if(urls.length == 0){
        alert('You need to enter urls to check for CORS');
    }
    return urls;
 }

 function cors() {
    document.getElementById("cors_result").innerHTML = '';
    urls = get_urls('cors_urls');
    for (i in urls){
        var xhttp = new XMLHttpRequest();
        xhttp.onreadystatechange = function() {
            if (this.readyState == 4 && this.status == 200) {
                let init_result = document.getElementById("cors_result").innerHTML;
                document.getElementById("cors_result").innerHTML = init_result +"<br> <h2>"+urls[i]+ "</h2> <code>" + this.responseText + "</code><hr />";
            }
        };
        xhttp.open("GET", urls[i], true);
        xhttp.withCredentials = true;
        xhttp.send();
    }
 }

 function clickjackingTesting(urls){
    document.getElementById("iframe_result").innerHTML = '';
    urls = get_urls('iframe_urls');
    for (i in urls){
        let newFrame = document.createElement('iframe');
        console.log(urls[i]);
        newFrame.src = urls[i];
        let iframe_result = document.getElementById('iframe_result');
        iframe_result.appendChild(newFrame);
        // console.log('newFrame.contentWindow =', newFrame.contentWindow);
    }
 }

 </script>
 </head>
 <body>
    <center>
        <div class="split left">
            <h2>CORs POC</h2>
            <textarea rows="10" cols="60" id="cors_urls"></textarea><br>
            <button type="button" onclick="cors()">CORS Exploit</button>
            <p id="cors_result"></p>
        </div>
        <div class="split right">
            <h2>Clickjacking POC</h2>
            <textarea rows="10" cols="60" id="iframe_urls"></textarea><br>
            <button type="button" onclick="clickjackingTesting()">Clickjacking Exploit</button>
            <p id="iframe_result"></p>
        </div>
    </center>
 </body>
 </html>
	<!DOCTYPE html>
	<html>
	<head>
	<meta charset="utf-8"/>
	<title>CORS and Clickjacking checker</title>
	<style>
	body {
	font-family: Arial;
	color: white;
	}
	.split {
	height: 100%;
	width: 50%;
	position: fixed;
	z-index: 1;
	top: 0;
	overflow-x: hidden;
	padding-top: 20px;
	}

	.left {
	left: 0;
	background-color: rgb(63, 196, 226);
	}

	.right {
	right: 0;
	background-color: #77ae50;
	}
	</style>

	<script>
	function get_urls(id_txtarea){
	txtarea = document.getElementById(id_txtarea);
	urls = txtarea.value.split('\n');
	if(urls.length == 0){
	alert('You need to enter urls to check for CORS');
	}
	return urls;
	}

	function cors() {
	document.getElementById("cors_result").innerHTML = '';
	urls = get_urls('cors_urls');
	for (i in urls){
	var xhttp = new XMLHttpRequest();
	xhttp.onreadystatechange = function() {
	if (this.readyState == 4 && this.status == 200) {
	let init_result = document.getElementById("cors_result").innerHTML;
	document.getElementById("cors_result").innerHTML = init_result +"<br> <h2>"+urls[i]+ "</h2> <code>" + this.responseText + "</code><hr />";
	}
	};
	xhttp.open("GET", urls[i], true);
	xhttp.withCredentials = true;
	xhttp.send();
	}
	}

	function clickjackingTesting(urls){
	document.getElementById("iframe_result").innerHTML = '';
	urls = get_urls('iframe_urls');
	for (i in urls){
	let newFrame = document.createElement('iframe');
	console.log(urls[i]);
	newFrame.src = urls[i];
	let iframe_result = document.getElementById('iframe_result');
	iframe_result.appendChild(newFrame);
	// console.log('newFrame.contentWindow =', newFrame.contentWindow);
	}
	}

	</script>
	</head>
	<body>
	<center>
	<div class="split left">
	<h2>CORs POC</h2>
	<textarea rows="10" cols="60" id="cors_urls"></textarea><br>
	<button type="button" onclick="cors()">CORS Exploit</button>
	<p id="cors_result"></p>
	</div>
	<div class="split right">
	<h2>Clickjacking POC</h2>
	<textarea rows="10" cols="60" id="iframe_urls"></textarea><br>
	<button type="button" onclick="clickjackingTesting()">Clickjacking Exploit</button>
	<p id="iframe_result"></p>
	</div>
	</center>
	</body>
	</html>