skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

enum-cors-csp

Enumerate and classify CORS policies and CSP directives across web endpoints.

Updated Jul 30, 2026
Search Tags:#security#csp#cors#headers#enumeration#pentest
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill enum-cors-csp
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: enum-cors-csp
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/enum-cors-csp
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill enum-cors-csp

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the complexity of auditing client-side security boundaries by automating the discovery of CORS misconfigurations and CSP directive gaps that could lead to cross-origin data exfiltration or content injection.

Core Features & Use Cases

  • CORS Policy Classification: Automatically probes endpoints to identify reflected origins, credential-bearing CORS (ACAC: true), and potential trust-chain weaknesses.
  • CSP Directive Audit: Parses and evaluates Content Security Policy headers to flag dangerous directives like unsafe-inline, unsafe-eval, or overly permissive wildcards.
  • Use Case: During a security assessment, use this skill to quickly map which API endpoints are vulnerable to cross-origin attacks and verify if the application's CSP provides adequate defense-in-depth.

Quick Start

Use the enum-cors-csp skill to audit the security headers and cross-origin trust boundaries for all endpoints defined in the current scope file.

Frequently Asked Questions about enum-cors-csp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit CORS misconfigurations and CSP directive gaps during a security assessment?▼

To audit CORS misconfigurations and CSP directive gaps, systematically probe endpoints for reflected origins and credential-bearing CORS, then parse Content Security Policy headers to flag dangerous directives like unsafe-inline, unsafe-eval, or overly permissive wildcards.

What is cross-origin trust boundary mapping and when do I need it for bug bounty reconnaissance?▼

Cross-origin trust boundary mapping identifies client-side trust relationships by enumerating CORS policies and CSP directives across web endpoints. You need it during bug bounty reconnaissance to locate cross-origin data exfiltration risks and content injection vectors from configuration gaps.

How do I check for credential-bearing CORS and unsafe-inline CSP headers across web application endpoints?▼

Checking for credential-bearing CORS and unsafe-inline CSP headers requires controlled origin probing and systematic header analysis to classify ACAC: true responses and evaluate Content Security Policy directives for dangerous inline script permissions across all defined scope endpoints.

Does this CSP and CORS enumeration approach work for defensive hardening workflows as well as pentest reconnaissance?▼

This CSP and CORS enumeration approach works for both defensive hardening workflows and pentest reconnaissance by mapping client-side trust boundaries to identify configuration gaps, verify defense-in-depth adequacy, and locate cross-origin attack vulnerabilities across application endpoints.

What are the limitations of automated CORS policy classification and CSP directive auditing?▼

Automated CORS policy classification and CSP directive auditing limitations include relying on systematic header analysis and controlled origin probing, which may miss dynamically generated policies, context-dependent trust-chain weaknesses, or complex JavaScript-driven content injection scenarios not visible in static headers.

Related Skills

Explore More Software Engineering Skills→
ricardoo022ricardoo022

scan-fase-7

Identify HTTP security header misconfigurations and bypass opportunities across endpoints.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

cors-misconfiguration

Detect CORS misconfigurations and generate JavaScript proof-of-concept exploits.

Official
Advanced
macaughmacaugh
5

Web Application Reconnaissance

Harvests and analyzes web app endpoints and metadata for reconnaissance workflows.

Community
Advanced
elementalsoulselementalsouls
3.3k

hunt-cors

Detect CORS misconfigurations allowing credentialed cross-origin reads with browser PoCs.

Community
Advanced