CORS exploitation
ACAO reflecting Origin plus ACAC true on a cookie-auth API is a read gadget against the victim session. ACAO: * without credentials is usually nothing.
Playbooks
- CORS Misconfiguration - Abuse permissive cross-origin policies to read authenticated responses from a victim's browser.
Gadgets
- CORS reflection - Worthless with ACAO: * and no credentials. Dangerous when ACAO reflects Origin AND ACAC: true on an authenticated API.
- JSONP / callback parameter - Legacy JSONP with a reflected callback and cookies is an XSS/CORS-bypass gadget on old APIs.
- CSRF without a real origin check - State-changing cookie-auth requests that accept a cross-site POST become account or billing actions. JSON plus a missing CORS preflight is the modern shape.
Bypasses
- CORS misconfiguration - Find an origin the server will trust with credentials. Confirm with the CSP/CORS checks on /utils/.
Tools
- Corsy - CORS misconfig scanner (reflection, null origin, substring). Confirm ACAC plus a cookie-auth API before you call it ATO.
Questions
Is reflected Origin always ATO?
Only with credentials and an endpoint that returns data worth stealing. Test the error path. 401 handlers often reflect when the happy path does not.
What about null Origin?
Sandboxed iframes send Origin: null. If the API allows it with ACAC, you have a gadget.
This page is the public form of hunt_brief("cors") on the MCP connector. Authorized testing only.