skills.rest
elementalsouls
elementalsoulsCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-cors

Detect CORS misconfigurations allowing credentialed cross-origin reads with browser PoCs.

3.3k|507|Updated May 5, 2026
Search Tags:#vulnerability#web-security#cors#preflight#bug-hunting#cross-origin#browser-poc
One-click install
npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-cors-elementalsouls
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-cors
Source: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-cors
Command: npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-cors-elementalsouls

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Cross-origin resource sharing misconfigurations can expose sensitive data when credentials are allowed from attacker-controlled origins. This skill guides testers through systematic CORS hunting across endpoints, preflight behavior, and browser-proof validation to prevent data leakage.

Core Features & Use Cases

  • Phase-driven methodology to identify CORS misconfigurations, including origin reflection, null-origin trust, and regex-based trusted origin pitfalls.
  • Browser PoC workflows to confirm real impact, with guidance on artifact collection and evidence hygiene.
  • Automation-friendly steps and practical testing patterns for web APIs, SPAs, and enterprise apps.

Quick Start

Follow Phases 1 through 6 to profile, verify, and document a CORS misconfiguration with a browser-based PoC.

Frequently Asked Questions about hunt-cors

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test CORS misconfigurations for credentialed cross-origin reads?▼

Origin reflection occurs when a server echoes back any attacker-supplied Origin header value in the Access-Control-Allow-Origin response, bypassing allowlist validation and enabling credentialed cross-origin data theft from web APIs.

How do I create a browser PoC to demonstrate CORS data leakage impact?▼

Null-origin trust exploits servers that allow the null origin in credentialed requests, which attackers generate using sandboxed iframes or cross-origin protocols, bypassing trusted origin restrictions to read sensitive web API data.

What is the best way to hunt CORS preflight bypass issues in SPAs?▼

Regex-based trusted origin pitfalls happen when server origin validation regex is overly permissive, allowing attacker-controlled subdomains to match trusted patterns and gain credentialed cross-origin access to sensitive API endpoints.

Do I need specific tools to run CORS hunting phases on enterprise apps?▼

CORS preflight bypass testing examines whether servers improperly handle OPTIONS requests or skip validation on simple requests, allowing cross-origin reads without proper preflight checks across common web frameworks and API endpoints.

Why does my CORS testing fail to confirm data leakage on some API endpoints?▼

Browser-proof CORS validation requires executing actual cross-origin fetch requests with credentials in a browser environment, collecting response artifacts as evidence, and maintaining evidence hygiene to demonstrate real sensitive data exposure.

Related Skills

Explore More Software Engineering Skills→
Q16GQ16G
83

cors-misconfiguration

Analyze CORS response headers to identify misconfigurations in web APIs.

Community
Intermediate
RepairYourTechRepairYourTech
6

csp-cors-headers

Configure CSP, CORS, and HTTP security headers for web applications.

Community
Advanced
DorianGalloDorianGallo
5

cors-cross-origin-misconfiguration

Diagnose CORS misconfigurations that expose authenticated API responses to cross-origin reads.

Community
Advanced
utsavthakurutsavthakur

cors-cross-origin-misconfiguration

Detect CORS misconfigurations in web applications by analyzing HTTP headers.

Community
Advanced