cors-cross-origin-misconfiguration

What problem does it solve?

This Skill helps you identify CORS misconfigurations that allow cross-origin pages to read authenticated API responses, turning browser trust mistakes into real data exposure.

Core Features & Use Cases

• Credentialed CORS exposure analysis: Triages Access-Control-Allow-Origin, Access-Control-Allow-Credentials, and preflight behavior to determine whether an attacker-controlled origin can read responses with cookies.
• Origin validation failure patterns: Reviews reflection, wildcard/allowlist bypasses, null origin acceptance, and caching mistakes (missing Vary: Origin) that can enable CORS cache poisoning.
• Actionable exploitation scenarios: Provides JSONP hijacking context, null-origin sandbox testing, Vary/origin caching verification, and an end-to-end internal-network CORS exploitation chain for realistic assessment.

Quick Start

Use the cors-cross-origin-misconfiguration skill to test a target endpoint for reflected origins, credential handling, preflight policy issues, and bypassable trust boundaries.