skills.rest
412181-HerediaLara
412181-HerediaLaraCOMMUNITY
Explore all skills by this author →
GitHub

cors-cross-origin-misconfiguration

Tests CORS configurations for origin reflection, credential exposure, and allowlist bypass vulnerabilities.

Updated Jun 28, 2026
Search Tags:#security testing#penetration testing#web security#cors#cross-origin#jsonp hijacking#origin reflection
One-click install
npx skills add https://github.com/412181-HerediaLara/ScaffoldingBE-FE --skill cors-cross-origin-misconfiguration-412181-heredialara
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cors-cross-origin-misconfiguration
Source: https://github.com/412181-HerediaLara/ScaffoldingBE-FE/tree/main/BE/.agents/skills/cors-cross-origin-misconfiguration
Command: npx skills add https://github.com/412181-HerediaLara/ScaffoldingBE-FE --skill cors-cross-origin-misconfiguration-412181-heredialara

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web APIs often misconfigure Cross-Origin Resource Sharing headers, allowing malicious websites to read authenticated user data cross-origin. This Skill provides a structured testing playbook to detect reflected origins, wildcard-with-credentials flaws, null origin acceptance, regex bypasses, and cache poisoning issues before attackers exploit them. ## Core Features & Use Cases - Origin Reflection & Credential Testing: Craft Origin headers to detect servers that echo arbitrary origins while allowing credentialed requests, enabling cross-origin data theft. - Allowlist Bypass Probing: Test regex flaws, subdomain matching errors, Unicode normalization, and null origin acceptance via sandboxed iframes. - Advanced Attack Chains: Covers subdomain XSS to CORS bypass chains, Vary: Origin cache poisoning, internal network exploitation, DNS rebinding, and JSONP hijacking scenarios. - Use Case: During a web application security assessment, you discover an API returning Access-Control-Allow-Origin headers. Use this Skill to systematically test whether an attacker-controlled origin can read authenticated responses and chain the finding into account-level impact. ## Quick Start Analyze this API's CORS configuration and test whether an attacker-controlled origin can read authenticated responses cross-origin.

Frequently Asked Questions about cors-cross-origin-misconfiguration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for CORS misconfiguration vulnerabilities?▼

Send requests with crafted Origin headers and check whether the server reflects them in Access-Control-Allow-Origin. Then test with credentials included, probe allowlist bypasses using attacker subdomains, and check if the null origin is accepted.

What is the null origin CORS exploit?▼

A sandboxed iframe, data: URI, or file: page sends Origin: null. If the server allows or reflects the null origin with credentials enabled, attacker JavaScript inside the sandbox can read authenticated API responses cross-origin.

How does subdomain XSS lead to CORS bypass?▼

If an API allows CORS from *.target.com, XSS on any subdomain lets attacker JavaScript make credentialed requests that pass the allowlist. Same-site cookies are sent and the CORS policy permits reading the response.

Why does missing Vary: Origin cause CORS cache poisoning?▼

When a server reflects the Origin header without Vary: Origin, caches may serve a response containing an attacker's Access-Control-Allow-Origin value to other users. Victims' browsers then allow the attacker origin to read cached responses.

What regex mistakes allow CORS origin validation bypass?▼

Common flaws include unanchored patterns, substring matching, and overly broad wildcards. Bypass payloads include attacker.com/.target.com, target.com.attacker.com, and Unicode homoglyph domains that normalize differently between validator and browser.

Can CORS misconfigurations expose internal network services?▼

Yes. Internal APIs using Access-Control-Allow-Origin: * can be read by JavaScript on any page an internal employee visits. Timing differences also enable internal port scanning, and DNS rebinding can bypass same-origin restrictions entirely.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

enum-cors-csp

Enumerate and classify CORS policies and CSP directives across web endpoints.

Community
Advanced
jinyimeng01jinyimeng01
54

report-agent

Generate HackerOne-format vulnerability reports from validated security findings.

Community
Advanced
allthriveaiallthriveai

csrf-auth-debugger

Debug CSRF and JWT authentication issues in Django projects.

Official
Advanced
xalgordxalgord
954

performing-exploit-verification

Verifies suspected vulnerabilities with reproducible exploit proof before reporting findings.

Community
Advanced