Detect and validate CORS misconfigurations with browser-based proof-of-concept.
npx skills add https://github.com/Skobyn/talon --skill hunt-cors-skobyn
Please help me install this Agent Skill. Skill: hunt-cors Source: https://github.com/Skobyn/talon/tree/main/skills/hunt-cors Command: npx skills add https://github.com/Skobyn/talon --skill hunt-cors-skobyn
This Skill helps identify potential Cross-Origin Resource Sharing (CORS) misconfigurations in web applications, ensuring sensitive data is not vulnerable to unauthorized access.
Use the hunt-cors skill to check for CORS misconfigurations in your web application 'acme.com'.
High-intent search queries and answers about installing and using this skill.
Detect CORS misconfigurations by examining server responses and reflecting attacker-controlled origins to identify credentialed cross-origin reads of sensitive data. This process targets servers allowing unauthorized access, null origin trust, and other configuration vulnerabilities.
A CORS vulnerability occurs when server responses improperly allow credentialed cross-origin data access, exposing sensitive data to unauthorized domains. Misconfigured trust for attacker-controlled or null origins enables malicious sites to read private application data.
Validate a CORS vulnerability finding by creating a browser-based proof-of-concept to confirm the exploitation. This confirms that detected misconfigurations, like credentialed cross-origin reads, can actually be exploited to access sensitive data.
Yes, you can scan for null origin trust and credentialed cross-origin access. The detection process specifically examines server responses for these misconfigurations to prevent unauthorized access to sensitive data before web application deployment.
The best way to check for CORS misconfigurations before deployment is to scan for credentialed cross-origin access and null origin trust, then validate findings with a browser-based proof-of-concept to ensure sensitive data is protected against data breaches.
ricardoo022Identify configurations, secrets, and attack-surface exposure from JS-bundled web applications.
uphiagoDetect CORS misconfigurations enabling credentialed cross-origin reads of authenticated data.
gitgoodordietryingAudit codebases and infrastructure for dependency vulnerabilities, secrets, and misconfigurations.
blacklanternsecurityDetect CORS misconfigurations and generate JavaScript proof-of-concept exploits.
