skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

cors

Test CORS configurations for origin reflection and credential-bearing requests.

Updated Jul 30, 2026
Search Tags:#security#vulnerability#api#web-security#cors#pentest
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill cors-salmanabdurrahman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cors
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/cors
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill cors-salmanabdurrahman

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the risk of Cross-Origin Resource Sharing (CORS) misconfigurations, which can lead to unauthorized credentialed data access and sensitive information leakage.

Core Features & Use Cases

  • Policy Discovery: Automatically identifies origin reflection, wildcard usage, and credential-bearing CORS configurations.
  • Bypass Testing: Probes for common security gaps including null-origin, subdomain trust-chain abuse, and protocol downgrade vulnerabilities.
  • Use Case: Security engineers can use this to audit authenticated API endpoints to ensure that sensitive user data is protected from cross-origin exploitation by unauthorized third-party domains.

Quick Start

Use the cors skill to audit the authentication endpoints defined in the current scope for origin reflection and credential leakage.

Frequently Asked Questions about cors

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test my API for CORS origin reflection vulnerabilities?▼

Test CORS origin reflection by probing authorized web APIs to check if the server echoes arbitrary origin values in the Access-Control-Allow-Origin header while allowing credentialed requests to expose sensitive data.

What is a CORS misconfiguration that leads to sensitive data leakage?▼

A CORS misconfiguration causing sensitive data leakage occurs when wildcard origins or subdomain trust-chains allow unauthorized third-party domains to extract authenticated user data via cross-origin requests.

How do I audit authenticated web API endpoints for cross-origin security?▼

Audit authenticated web API endpoints by validating preflight handling, probing for null-origin bypasses, and testing credential-bearing requests to ensure sensitive user data is protected from unauthorized cross-origin exploitation.

Can I test for null-origin and subdomain trust-chain bypasses in CORS policies?▼

Yes, you can test for null-origin and subdomain trust-chain bypasses by probing target web APIs for common security gaps, including protocol downgrade vulnerabilities and subdomain trust-chain abuse.

What authorization is required to safely perform CORS security assessments?▼

Safe CORS security assessments require adherence to strict authorization gates, scope validation, and evidence-based reporting protocols to ensure testing only targets authorized web APIs within the defined scope.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

okta-attack

Discover Okta tenants and analyze authentication flows for security misconfigurations.

Community
Advanced
utsavthakurutsavthakur

cors-cross-origin-misconfiguration

Detect CORS misconfigurations in web applications by analyzing HTTP headers.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

cors-misconfiguration

Detect CORS misconfigurations and generate JavaScript proof-of-concept exploits.

Official
Advanced
uphiagouphiago
1.1k

cors-chain-automation

Probe API endpoints for exploitable CORS misconfigurations and generate PoC files.

Community
Intermediate