hunt-cors

Identifies misconfigured CORS policies that allow credential abuse via header analysis.

Updated Jun 5, 2026

Search Tags:#vulnerability #web-security #cors #pentesting #security-testing #cross-origin #cors-misconfiguration

Ready to run

npx skills add https://github.com/sseshachala/Claude-BugHunter-archive --skill hunt-cors

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-cors
Source: https://github.com/sseshachala/Claude-BugHunter-archive/tree/main/skills/hunt-cors
Command: npx skills add https://github.com/sseshachala/Claude-BugHunter-archive --skill hunt-cors

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CORS misconfigurations can expose sensitive data by allowing malicious origins to access authenticated responses. This Skill helps identify problematic patterns like reflect-any-origin with credentials, null-origin trust, and subdomain regex bypass.

Core Features & Use Cases

Detects common CORS misconfigurations across APIs and SPAs.
Provides a structured hunting methodology to validate origin checks and postMessage handling.
Suitable for red-team readiness and bug-bounty testing in web apps.

Quick Start

Run an initial CORS assessment against a target API to verify origin reflection, credentials, and preflight handling.

Frequently Asked Questions about hunt-cors

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for CORS misconfigurations in a web application?▼

To test CORS misconfigurations, scan API endpoints and SPAs for vulnerable Access-Control-Allow-Origin patterns like reflect-any-origin, null-origin trust, and subdomain regex bypasses using header injection and preflight validation.

What is a CORS origin reflection vulnerability?▼

A CORS origin reflection vulnerability occurs when a server reflects any attacker-controlled origin in the Access-Control-Allow-Origin header while allowing credentials, enabling malicious sites to read authenticated API responses.

How do I bypass CORS subdomain regex restrictions during pentesting?▼

Bypass CORS subdomain regex restrictions by injecting crafted origin headers that exploit weak regex patterns, validating if the target incorrectly trusts attacker-controlled subdomains to access protected responses.

Can I use this to check postMessage origin handling in SPAs?▼

Yes, you can check postMessage origin handling in SPAs by applying a structured hunting methodology to validate if origin checks properly restrict message passing from untrusted cross-origin sources.

Does this CORS testing method work for bug bounty and red team readiness?▼

Yes, this CORS testing method works for bug bounty and red team readiness by validating preflight considerations and header injection to identify misconfigured policies exposing authenticated data.

Why does a null origin bypass CORS policies and how is it tested?▼

A null origin bypasses CORS policies when servers explicitly trust the null origin value, often triggered by sandboxed iframes or local files, and is tested by injecting the null origin to access protected responses.