hunt-cors

Detects and verifies CORS misconfigurations that allow unauthorized cross-origin access.

Updated Jul 1, 2026

Search Tags:#web security #vulnerability detection #CORS #security auditing #browser proof of concept

Ready to run

npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-cors-bpnrockstar

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-cors
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/hunt-cors
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-cors-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Identifies Cross-Origin Resource Sharing (CORS) misconfigurations that could be exploited to read sensitive data across domains.

Core Features & Use Cases

Misconfiguration Detection: Automatically checks for common CORS configuration issues.
Browser Proof of Concept (PoC): Verifies actual access using a browser to ensure exploitability.
Use Case: For security analysts, developers, or auditors who need to scan web applications for vulnerabilities in their CORS setup.

Quick Start

Use the hunt-cors skill to check for CORS misconfigurations on the target server 'https://target.com'.

Frequently Asked Questions about hunt-cors

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect CORS misconfigurations that allow unauthorized cross-origin access?▼

Detecting CORS misconfigurations involves automatically scanning target servers for common configuration issues that allow unauthorized cross-origin data access, identifying vulnerable HTTP response headers and access controls before they can be exploited.

How can I verify if a CORS vulnerability is actually exploitable in a browser?▼

You can verify CORS exploitability by generating a browser proof of concept that tests actual data access across domains, confirming whether the misconfiguration truly allows unauthorized reads under real browser security constraints.

Do I need curl and browser knowledge to test for CORS vulnerabilities?▼

Yes, testing for CORS vulnerabilities requires tools like curl and basic browser knowledge. These are necessary to manually send cross-origin requests, analyze HTTP response headers, and verify actual data access during security auditing.

What is the best way to audit a web application's CORS setup for data leakage?▼

The best way to audit a web application's CORS setup is to proactively scan for misconfigurations and verify findings with a browser proof of concept, ensuring any unauthorized cross-origin access to sensitive data is accurately identified and reported.

Can I use this approach to check specific target servers for CORS issues?▼

Yes, you can check specific target servers for CORS issues by directing the scan to the target URL. The process automatically checks for common misconfigurations and verifies whether sensitive data can be read across domains.