Hunt Cors
Hunt CORS Misconfiguration, origin-reflection with credentials, null-origin trust...
Install
npx skills add elementalsouls/Claude-BugHunter --skill hunt-cors -g -a claude-code -y- Repository
- elementalsouls/Claude-BugHunter5.4k
- Category
- Testing
- Updated
- 3d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Hunt CORS Misconfiguration, origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled origin can perform a CREDENTIALED cross-origin read of sensitive data and you have proven it in a browser. Use when testing API endpoints, SPAs, or any app emitting Access-Control-* headers.
HUNT-CORS, Cross-Origin Resource Sharing Misconfiguration
What actually pays (and what does not)
CORS pays High only when an attacker-controlled origin can perform a
credentialed cross-origin read of sensitive authenticated data, and you
have a browser PoC proving the response body is readable from evil.com.
Two hard browser rules that kill most "findings", check these FIRST:
Access-Control-Allow-Origin: *CANNOT be combined with credentials. If the server returnsACAO: *, the browser refuses to send/expose the response for acredentials: includerequest. A wildcard-only endpoint is not credential-exploitable. It is only interesting if the data it serves is sensitive without a session (rare), usually this is Informational/Low.Access-Control-Allow-Credentials: trueis meaningless on its own. It matters only ifACAOreflects/allows your specific attacker origin AND a cross-origin credentialedfetchactually returns a readable body. ACAC on a response that does not reflect your origin proves nothing.
If you cannot demonstrate a readable cross-origin authed body in a real browser, you do not have a High. Do not submit header-diffing alone.
