Basic (CORS: True)

OR maybe simpler script

Host webpage -> send to victim -> if he clicks it u get his key.