skills.rest
blacklanternsecurity
blacklanternsecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

cors-misconfiguration

Detect CORS misconfigurations and generate JavaScript proof-of-concept exploits.

253|37|Updated Feb 22, 2026
Search Tags:#penetration testing#web security#cors#data exfiltration#cross-origin#vulnerability exploitation
One-click install
npx skills add https://github.com/blacklanternsecurity/red-run --skill cors-misconfiguration
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cors-misconfiguration
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/cors-misconfiguration
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill cors-misconfiguration

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify and exploit Cross-Origin Resource Sharing (CORS) misconfigurations, allowing unauthorized origins to access sensitive data from web applications.

Core Features & Use Cases

  • CORS Header Analysis: Detects vulnerable CORS configurations like reflected origins, null origins, and wildcard usage.
  • Exploitation PoCs: Provides JavaScript snippets to demonstrate data exfiltration via XHR or Fetch API.
  • Use Case: A penetration tester can use this skill to demonstrate how an attacker-controlled website could steal user session cookies or sensitive profile information from a vulnerable target application.

Quick Start

Use the cors-misconfiguration skill to test the target 'https://example.com/api/user/profile' for CORS vulnerabilities.

Frequently Asked Questions about cors-misconfiguration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit CORS misconfigurations to steal sensitive data?▼

Identify CORS misconfigurations by analyzing HTTP headers for origin reflection, null origin trust, wildcard origins, and regex bypasses. This skill detects these vulnerabilities and generates JavaScript proof-of-concept snippets to demonstrate data exfiltration.

What types of CORS header vulnerabilities can be detected during penetration testing?▼

Detectable CORS vulnerabilities include reflected origins, null origins, wildcard origins, and regex bypasses. Analyzing these configurations reveals how unauthorized web origins can access sensitive application data.

How can I test if my web application is vulnerable to cross-origin data exfiltration?▼

Test for cross-origin data exfiltration by targeting specific API endpoints to check for CORS misconfigurations. The skill analyzes target URLs for unsafe origin handling and provides JavaScript PoCs to simulate credential theft.

Can I generate a JavaScript proof-of-concept for credential theft via CORS?▼

Yes, you can generate JavaScript proof-of-concept snippets for credential theft using XHR or the Fetch API. These scripts demonstrate how an attacker-controlled website could exfiltrate sensitive profile information from a vulnerable application.

Do I need any specialized dependencies to scan for CORS origin reflection?▼

No specialized dependencies are required to scan for CORS origin reflection. The skill operates autonomously to analyze HTTP headers and identify unsafe cross-origin resource sharing configurations.

Related Skills

Explore More Software Engineering Skills→
ricardoo022ricardoo022

scan-fase-7

Identify HTTP security header misconfigurations and bypass opportunities across endpoints.

Community
Advanced
securityfortechsecurityfortech
6

cors-misconfig

Detect and exploit CORS misconfigurations in web applications.

Official
Intermediate
jokken79jokken79
1

Burp Suite Web Application Testing

Intercept, modify, and analyze HTTP traffic to identify web application vulnerabilities.

Community
Advanced
DevHive1DevHive1
18

security_scan

Orchestrate dependency, static analysis, and privacy dataflow scanners into prioritized reports.

Community
Advanced