I found an XSS on subdomain.example.com
, is it possible to use that xss to extract the response of an api request from the main domain example.com/api/xyz
?
The xss is on subdomain.example.com
and I'd like to extract the whole response of www.example.com/api/xyz
. Is it possible to do it via XSS?
If possible, which javascript code could I use?