cors-misconfig

You can test for CORS misconfigurations by sending a request with an attacker-controlled origin to the target URL. This detects servers improperly reflecting the Origin header, potentially allowing sensitive data exfiltration from a victim's browser.

A CORS null origin vulnerability occurs when a server accepts `null` as a valid origin, often exploitable via sandboxed iframes. This misconfiguration allows an attacker to read sensitive API responses that should be restricted.

You exploit wildcard origins with credentials by testing if the server returns `Access-Control-Allow-Origin: *` combined with credentialed requests. This misconfiguration enables unauthorized cross-origin reads of authenticated sensitive API data.

Yes, testing for CORS vulnerabilities requires tools like Burp Suite or OWASP ZAP to intercept and modify requests. You also need an attacker-controlled HTTPS server to demonstrate proof-of-concept sensitive data exfiltration.

Reflecting the Origin header creates a web security vulnerability because it bypasses the Same-Origin Policy. An attacker-controlled site can then make authenticated cross-origin requests and read sensitive API responses from the victim's session.