skills.rest
AeonDave
AeonDaveCOMMUNITY
Explore all skills by this author →
GitHub

corsy

Scan web applications for exploitable CORS misconfigurations.

15|1|Updated Feb 12, 2026
Search Tags:#penetration testing#web security#cors#misconfiguration#vulnerability scanner
One-click install
npx skills add https://github.com/AeonDave/malskill --skill corsy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: corsy
Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/web-app/corsy
Command: npx skills add https://github.com/AeonDave/malskill --skill corsy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires corsy, and includes references (resource) components.

What problem does it solve?

This Skill identifies exploitable Cross-Origin Resource Sharing (CORS) misconfigurations in web applications, which can lead to security vulnerabilities like cross-origin data theft.

Core Features & Use Cases

  • CORS Misconfiguration Scanning: Detects various types of exploitable CORS flaws, including reflected origins, trusted null origins, prefix/suffix matches, and trusted subdomains.
  • Authenticated Scanning: Supports scanning endpoints that require authentication via custom headers.
  • Bulk Scanning: Can process a list of URLs from a file for efficient vulnerability assessment.
  • Use Case: A security analyst needs to quickly assess a web application for common CORS misconfigurations that could be exploited by an attacker to steal sensitive user data.

Quick Start

Use the corsy skill to scan the target URL https://example.com for CORS vulnerabilities.

Frequently Asked Questions about corsy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a web application for exploitable CORS misconfigurations?▼

The scanner identifies reflected origins, trusted null origins, prefix/suffix matches, and trusted subdomains. These misconfigurations allow attackers to bypass the same-origin policy and steal sensitive user data across origins.

Can I scan multiple URLs for CORS vulnerabilities at the same time?▼

Yes, bulk scanning is supported by processing a list of URLs from a file. This allows you to efficiently assess multiple web application endpoints for CORS misconfigurations in a single run.

Does the CORS scanner support authenticated endpoints requiring custom headers?▼

Yes, authenticated scanning is supported via custom headers. You can supply the necessary authentication headers to test CORS vulnerabilities on endpoints that require user login or authorization.

What types of CORS misconfigurations can be detected on HTTPS endpoints?▼

The scanner detects HTTP allowed on HTTPS endpoints, along with reflected origins, trusted null origins, and prefix/suffix match misconfigurations that could lead to cross-origin data theft.

Why does a reflected origin header create a CORS vulnerability?▼

A reflected origin occurs when the server echoes back any arbitrary origin in the Access-Control-Allow-Origin header. This misconfiguration allows malicious websites to read authenticated responses cross-origin.

Related Skills

Explore More Software Engineering Skills→
alasdairncalasdairnc

security-audit

Audit CaseDive API endpoints and generate a 100-point security scorecard.

Community
Advanced
Prohao42Prohao42
120

cors-cross-origin-misconfiguration

Detect CORS misconfigurations by analyzing Access-Control-Allow-Origin response headers.

Community
Advanced
RooseveltAdvisorsRooseveltAdvisors
1

WebAssessment

Automate web application security assessments and generate prioritized penetration testing plans.

Community
Advanced
langbyyilangbyyi
96

cors-cross-origin-misconfiguration

Identify exploitable CORS misconfigurations enabling cross-origin theft of authenticated user data.

Community
Intermediate