CORS exploitation
ACAO reflecting Origin plus ACAC true on a cookie-auth API is a read gadget against the victim session. ACAO: * without credentials is usually nothing.
Skill
No skill is linked for this class yet. Start with the playbook on this page.
Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.
Checklists
None linked for this class yet.
Disclosures
- An API reflected the caller's origin and allowed credentials - CORS misconfiguration
Playbooks
- CORS Misconfiguration - Abuse permissive cross-origin policies to read authenticated responses from a victim's browser.
Bypasses
- CORS misconfiguration - Find an origin the server will trust with credentials. Confirm with the CSP/CORS checks on /utils/.
Questions
Is reflected Origin always ATO?
Only with credentials and an endpoint that returns data worth stealing. Test the error path. 401 handlers often reflect when the happy path does not.
What about null Origin?
Sandboxed iframes send Origin: null. If the API allows it with ACAC, you have a gadget.
This page is the linked pack hunt_brief("cors") returns on the MCP connector. Authorized testing only.