cors-misconfiguration

Detect CORS misconfigurations and generate JavaScript proof-of-concept exploits.

253|37|Updated Feb 22, 2026

Search Tags:#penetration testing #web security #cors #data exfiltration #cross-origin #vulnerability exploitation

Ready to run

npx skills add https://github.com/blacklanternsecurity/red-run --skill cors-misconfiguration

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cors-misconfiguration
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/cors-misconfiguration
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill cors-misconfiguration

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify and exploit Cross-Origin Resource Sharing (CORS) misconfigurations, allowing unauthorized origins to access sensitive data from web applications.

Core Features & Use Cases

CORS Header Analysis: Detects vulnerable CORS configurations like reflected origins, null origins, and wildcard usage.
Exploitation PoCs: Provides JavaScript snippets to demonstrate data exfiltration via XHR or Fetch API.
Use Case: A penetration tester can use this skill to demonstrate how an attacker-controlled website could steal user session cookies or sensitive profile information from a vulnerable target application.

Quick Start

Use the cors-misconfiguration skill to test the target 'https://example.com/api/user/profile' for CORS vulnerabilities.

Frequently Asked Questions about cors-misconfiguration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I exploit CORS misconfigurations to steal sensitive data?▼

Identify CORS misconfigurations by analyzing HTTP headers for origin reflection, null origin trust, wildcard origins, and regex bypasses. This skill detects these vulnerabilities and generates JavaScript proof-of-concept snippets to demonstrate data exfiltration.

What types of CORS header vulnerabilities can be detected during penetration testing?▼

Detectable CORS vulnerabilities include reflected origins, null origins, wildcard origins, and regex bypasses. Analyzing these configurations reveals how unauthorized web origins can access sensitive application data.

How can I test if my web application is vulnerable to cross-origin data exfiltration?▼

Test for cross-origin data exfiltration by targeting specific API endpoints to check for CORS misconfigurations. The skill analyzes target URLs for unsafe origin handling and provides JavaScript PoCs to simulate credential theft.

Can I generate a JavaScript proof-of-concept for credential theft via CORS?▼

Yes, you can generate JavaScript proof-of-concept snippets for credential theft using XHR or the Fetch API. These scripts demonstrate how an attacker-controlled website could exfiltrate sensitive profile information from a vulnerable application.

Do I need any specialized dependencies to scan for CORS origin reflection?▼

No specialized dependencies are required to scan for CORS origin reflection. The skill operates autonomously to analyze HTTP headers and identify unsafe cross-origin resource sharing configurations.