hunt-cors

To test CORS misconfigurations, scan API endpoints and SPAs for vulnerable Access-Control-Allow-Origin patterns like reflect-any-origin, null-origin trust, and subdomain regex bypasses using header injection and preflight validation.

A CORS origin reflection vulnerability occurs when a server reflects any attacker-controlled origin in the Access-Control-Allow-Origin header while allowing credentials, enabling malicious sites to read authenticated API responses.

Bypass CORS subdomain regex restrictions by injecting crafted origin headers that exploit weak regex patterns, validating if the target incorrectly trusts attacker-controlled subdomains to access protected responses.

Yes, you can check postMessage origin handling in SPAs by applying a structured hunting methodology to validate if origin checks properly restrict message passing from untrusted cross-origin sources.

Yes, this CORS testing method works for bug bounty and red team readiness by validating preflight considerations and header injection to identify misconfigured policies exposing authenticated data.

A null origin bypasses CORS policies when servers explicitly trust the null origin value, often triggered by sandboxed iframes or local files, and is tested by injecting the null origin to access protected responses.