What problem does it solve? CORS findings are frequently reported from curl header output alone, but browsers enforce rules that make most of those findings non-exploitable, producing false positives and rejected reports. This Skill provides an evidence-gated methodology that distinguishes genuinely exploitable CORS misconfigurations from header noise and proves impact with real browser PoCs. ## Core Features & Use Cases - Reflection and null-origin testing: Detects origin reflection combined with Access-Control-Allow-Credentials, and null-origin trust exploitable via sandboxed iframes. - Regex bypass classification: Maps trusted-origin regex flaws (missing end-anchor, unescaped dot, prefix-only, missing dot separator) to the exact bypass payload that matches each flaw class. - Pre-flight and postMessage analysis: Tests OPTIONS pre-flight authorization of arbitrary methods and headers, and audits JavaScript message handlers for missing or weak event.origin checks. - Use Case: While testing an authenticated API at /api/me, you observe the server reflects your Origin header. Use this Skill to confirm ACAC is set, build the browser fetch PoC, and verify the response body is actually readable cross-origin before reporting a High-severity finding. ## Quick Start Use the hunt-cors skill to test https://target.example/api/me for exploitable CORS misconfigurations and build a browser proof of concept.
