cors-cross-origin-misconfiguration

CORS Cross-Origin Misconfiguration is a security testing playbook for finding and exploiting flawed cross-origin resource sharing policies. It is meant to be loaded when responses carry Access-Control-Allow-Origin, Access-Control-Allow-Credentials, or preflight headers, when a browser-based attack path might read authenticated API responses, or when JSON endpoints appear CSRF-protected yet remain readable cross-origin. A companion SCENARIOS.md holds deeper material on JSONP hijacking, honeypot de-anonymization, same-origin policy internals, CORS-versus-JSONP comparison, and a dual-site attack lab.

The skill organizes testing around high-value misconfiguration classes: wildcard Access-Control-Allow-Origin combined with credentials, reflected arbitrary origins, weak allowlists (suffix, prefix, substring, regex, or case-matching errors), acceptance of the null origin, overbroad preflight trust, and internal or admin APIs readable cross-origin. A quick triage sends crafted Origin headers, tests with and without credentials, probes allowlist bypasses, and chains readable sensitive data to account or tenant impact.

Several concrete techniques are detailed with proof-of-concept code. Null-origin exploitation uses a sandboxed iframe (or data and file contexts) to send Origin: null so that a reflecting server leaks a credentialed response. A subdomain XSS to CORS bypass chain shows how an XSS on any target.com subdomain, combined with same-site cookies and a subdomain-trusting allowlist, yields full authenticated API reads. A Vary: Origin caching section explains CORS cache poisoning when a reflected origin is cached by a CDN or proxy without varying on origin, plus curl-based detection. A regex-bypass table enumerates flawed origin-validation patterns and payloads, including unicode homoglyph tricks, and a final section covers wildcard CORS on internal-network APIs. Related routes point to CSRF, OAuth/OIDC, and API/JWT skills.