cors

/cors

Find CORS misconfigurations that let an attacker page read authenticated responses cross-origin. Sends a battery of crafted Origin headers and inspects the Access-Control-Allow-Origin / Access-Control-Allow-Credentials reply.

Usage

/cors https://api.target.com/me
/cors https://api.target.com/me --cookie "session=abcd1234"
/cors -l recon/target.com/urls/api-endpoints.txt --json

Run directly:

tools/cors_scanner.py https://api.target.com/me --cookie "session=..."

What it tests

Origin sent	Detects
https://evil.example	arbitrary-origin reflection
null	sandboxed-iframe / data: URI trust
https://api.target.com.evil.example	weak endsWith (suffix) regex
https://notapi.target.com	weak startsWith (prefix) regex
https://attacker.api.target.com	blanket subdomain trust (chains w/ takeover)
http://api.target.com	https→http scheme downgrade

Severity

• CRITICAL — reflects attacker origin with ACAC: true (cookie-auth cross-origin read).
• HIGH — null origin trusted with credentials.
• MEDIUM — reflects attacker origin without credentials (exploitable when auth is a non-cookie token), or trusts http downgrade.
• INFO — ACAO: * with no credentials (usually intended public CORS).

Why a credentialed reflection is the win

ACAO: <attacker> + ACAC: true means fetch(url, {credentials:'include'}) from an attacker page returns the victim's authenticated response body — full account-data exfil. Pass --cookie with a live session to confirm the credentialed path.

Chain

CORS data-read → harvest CSRF token / PII / API keys from the response → escalate to ATO. A subdomain-trust CORS bug + a subdomain takeover on that subdomain = a clean credentialed-read exploit.