What problem does it solve? CORS misconfiguration reports are frequently rejected because testers submit header reflections that browsers would actually block, wasting triage time and producing false positives. This Skill provides a disciplined hunting methodology that distinguishes genuinely exploitable credentialed cross-origin reads from non-issues like wildcard ACAO headers. ## Core Features & Use Cases - Origin Reflection & Null-Origin Testing: Systematically probes endpoints for reflect-any-origin, null-origin trust, and trusted insecure HTTP origins using curl and httpx. - Regex Bypass Classification: Maps subdomain-trust regex flaws (unescaped dot, missing end-anchor, prefix-only) to the exact bypass payload that matches each flaw class, eliminating wasted tests. - Browser PoC Validation: Provides ready-to-adapt HTML payloads for credentialed cross-origin reads, sandboxed-iframe null-origin reads, and postMessage origin-check auditing, since curl cannot prove CORS exploitability. - Use Case: While testing a target's API, you find /api/me reflects your Origin header with ACAC: true. Use the Phase 5a browser PoC to prove the authenticated response body is readable from an attacker-controlled origin, then chain the stolen CSRF token into a state-changing request for a High-severity report. ## Quick Start Ask the agent to test https://target.com/api/me for CORS misconfigurations using your authenticated session cookie and produce a browser-verified proof of concept.
