skills.rest
ok-helloworld
ok-helloworldCOMMUNITY
Explore all skills by this author →
GitHub

cors-cross-origin-misconfiguration

Identify CORS misconfigurations enabling cross-origin reads of authenticated API responses.

241|28|Updated May 20, 2026
Search Tags:#security testing#cors#preflight#cross-origin#authenticated api#origin validation#credentialed requests
One-click install
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill cors-cross-origin-misconfiguration-ok-helloworld
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cors-cross-origin-misconfiguration
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/cors-cross-origin-misconfiguration
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill cors-cross-origin-misconfiguration-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

CORS misconfiguration can allow attackers to read authenticated API responses cross-origin by exploiting overly broad or incorrectly validated Origin handling, credential settings, JSONP-style behaviors, and caching or parsing edge cases.

Core Features & Use Cases

  • Credentialed cross-origin read analysis: evaluates when browsers can successfully read protected API responses using reflected or improperly validated CORS headers.
  • Trust-boundary validation checks: tests for wildcard trust, origin reflection bugs, allowlist bypass patterns (including null and subdomain edge cases), and preflight policy issues.
  • CORS chaining and real-world patterns: supports exploitation-context guidance for JSONP hijacking, same-origin policy internals, null-origin sandboxing, origin caching/Vary issues, and internal network CORS exposure.
  • Triage and testing workflow: provides step-by-step guidance to craft Origins, probe credentials behavior, and determine impact when sensitive data becomes readable.

Quick Start

Load this skill to test a target web application’s CORS behavior by inspecting its CORS headers and validating whether cross-origin JavaScript can read authenticated API responses using crafted Origin values and credentialed requests.

Frequently Asked Questions about cors-cross-origin-misconfiguration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test if my CORS configuration allows cross-origin reading of authenticated API responses?▼

To test CORS trust boundaries, you craft specific Origin values, probe credentialed request behavior, and validate ACAO, ACAC, and preflight headers to confirm if cross-origin JavaScript can read protected API responses.

What causes a CORS origin reflection vulnerability in web applications?▼

CORS origin reflection vulnerabilities occur when servers improperly reflect crafted Origin headers in the ACAO response, allowing credentialed cross-origin requests to read authenticated API data.

How can I bypass a CORS allowlist using null origin or subdomain edge cases?▼

CORS allowlist bypasses exploit null origin acceptance, subdomain wildcard parsing errors, and allowlist validation flaws to achieve unauthorized cross-origin reading of sensitive endpoints.

Does CORS preflight policy prevent credentialed cross-origin requests from reading API data?▼

CORS preflight policies can prevent credentialed cross-origin reads if configured correctly, but preflight policy bugs may allow cross-origin JavaScript to read authenticated API responses despite intended trust boundaries.

Why does my CORS configuration expose internal network APIs to cross-origin attacks?▼

Internal network CORS exposure happens when overly broad wildcard trust, incorrect origin validation, or caching and Vary header issues allow external origins to read internal authenticated API responses.

What is the best way to identify JSONP hijacking and CORS chaining patterns during a security assessment?▼

Identify JSONP hijacking and CORS chaining patterns by analyzing same-origin policy internals, null-origin sandboxing, and origin caching issues to determine exploitability for sensitive endpoints.

Related Skills

Explore More Software Engineering Skills→
Q16GQ16G
83

cors-misconfiguration

Analyze CORS response headers to identify misconfigurations in web APIs.

Community
Intermediate
EntroVyxEntroVyx
3

hunt-cors

Validate CORS misconfigurations for unauthorized credentialed access to sensitive data.

Community
Advanced
jinyimeng01jinyimeng01
54

http-smuggling

Detect HTTP request smuggling vulnerabilities via CL.TE, TE.CL, and TE.TE testing.

Community
Advanced
elementalsoulselementalsouls
3.3k

hunt-cors

Detect CORS misconfigurations allowing credentialed cross-origin reads with browser PoCs.

Community
Advanced