vulns.cofield index
Enter
Contribute
Testing playbook · intermediate

CORS Misconfiguration

Abuse permissive cross-origin policies to read authenticated responses from a victim's browser.

corsauthzdata-theft
Stable IDplaybook:cors-exploitationLast updatedLast verifiedLegacy review pendingProvenanceCurated workflow
Detection firstStop as soon as the evidence decisively supports or falsifies the hypothesis.

Every step requires authorization. Review side effects before running commands against a live system.

01

Probe ACAO reflection

Send an Origin header and see if it's reflected in Access-Control-Allow-Origin, especially with Access-Control-Allow-Credentials: true.

curl -s -H 'Origin: https://evil.com' https://target.com/api/me -I
httpx
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
02

Test weak validation

Try null origin, suffix/prefix matches (target.com.evil.com), and unescaped-dot regex bypasses.

curl -s -H 'Origin: null' https://target.com/api/me -I
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
03

Exploit

Host a page that fetches the victim's authenticated endpoint with credentials and exfiltrates the response. Impact = account data theft.

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Field notes

Common guidance

  • Reflected Origin + Allow-Credentials:true is almost always a finding.
  • null origin is reachable via a sandboxed iframe or data: URL.
Related tools

Mapped workflow tools

Toolhttpx
Sources

References

Version history: normalized permanent page created 2026-08-20.