Corsy
CORS misconfig scanner (reflection, null origin, substring). Confirm ACAC plus a cookie-auth API before you call it ATO.
Tags: cors, ato, api
- Category
- vuln
- Maintenance signal
- maintained
Use this when: CORS. A reflected origin is inventory until a credentialed response is readable.
Install
pipx
pipx install corsyCommand templates
Scan live hosts
corsy -i {input} -t 10 -o {output}