cors-chain-automation
Installation
SKILL.md
Multi-Endpoint CORS Triage
When to Use
Use when you have a list of API endpoints or target domains and need to systematically find credential-exploitable CORS misconfigurations at scale. Distinguishes the 3 exploitable patterns (reflect-any-origin + credentials, null-origin trust, subdomain-regex bypass) from false positives (ACAO: * alone, ACAC without reflected origin, same-origin-only). Generates ready-to-use browser PoC HTML files for confirmed findings.
CORS Variations
| # | Variation | Initial signal | Required follow-up |
|---|---|---|---|
| V1 | Origin reflection with credentials | Reflected origin and ACAC: true |
Credentialed browser reads protected data |
| V2 | Null-origin trust | ACAO: null and ACAC: true |
Sandboxed browser proof |
| V3 | Wildcard without credentials | ACAO: * |
Determine whether the data is already public |
| V4 | Credentialed preflight | OPTIONS accepts origin and method | Actual browser request succeeds |
| V5 | Protected-route CORS | CORS appears on a 401 or 403 | Approved session returns protected data |
| V6 | Broad origin reflection | Several unrelated origins are reflected | Controlled-origin browser proof |
| V7 | Namespace-specific CORS | Only one API or plugin namespace reflects | Validate that namespace's data or action |
| V8 | Environment-specific CORS | Policies differ across environments | Demonstrate impact within scope |