What problem does it solve? Web applications frequently misconfigure Cross-Origin Resource Sharing headers, allowing attacker-controlled pages to read authenticated API responses from a victim's browser. This Skill provides a structured testing playbook to detect reflected origins, wildcard-with-credentials flaws, null origin acceptance, regex allowlist bypasses, and cache poisoning issues before attackers exploit them. ## Core Features & Use Cases - Origin Reflection & Credential Testing: Send crafted Origin headers, test credentialed requests, and identify servers that echo arbitrary origins with Access-Control-Allow-Credentials enabled. - Allowlist Bypass Payloads: Probe weak regex and substring validators with payloads like attacker-controlled subdomains, Unicode homoglyphs, and null origins via sandboxed iframes. - Advanced Attack Chains: Covers subdomain XSS to CORS bypass chains, Vary: Origin cache poisoning, internal network API exfiltration, DNS rebinding, and JSONP hijacking scenarios in the companion SCENARIOS.md. - Use Case: During a web application penetration test, you discover an API returning Access-Control-Allow-Origin headers. Use this Skill to systematically test reflection behavior, attempt allowlist bypasses, and demonstrate credentialed data theft with a working proof-of-concept. ## Quick Start Use the CORS misconfiguration skill to test https://target.com/api/user for origin reflection and credentialed cross-origin read vulnerabilities.
