cors-check

What this skill does

Sends HTTP requests with various Origin header values to a target URL to detect vulnerabilities in CORS (Cross-Origin Resource Sharing) policy. Identifies misconfigurations such as Access-Control-Allow-Origin reflecting the request Origin verbatim, allowing null, or simultaneously setting * with Access-Control-Allow-Credentials: true.

When to use

• When auditing the CORS policy of an API endpoint
• When checking for Cross-Site Request Forgery (CSRF) or credential theft possibilities
• When validating CORS-based account takeover vulnerabilities in bug bounty programs

Prerequisites

• curl must be installed
• HTTP/HTTPS access to the target URL

Inputs