leoloobeek

// Evan Johnson - Misconfigured CORS and why web appsec is not getting easier - AppSecUSA 2016
// Stolen from presentation above for quick reference

//curl https://site.com -H "Origin: https://test.com" -I | grep "Access-Control-Allow"

$.ajax({
  
  url: "https://site.com/some/url"
  success: function( data ) {
      document.write("Key: " data['SOME_VAR']);

leoloobeek

# first: mkdir user && cd user && cp /path/to/get_gists.py .
# python3 get_gists.py user
import requests
import sys
from subprocess import call

user = sys.argv[1]

r = requests.get('https://api.github.com/users/{0}/gists'.format(user))