# Cors Cross Origin Misconfiguration

CORS misconfiguration testing playbook.

- Repository: https://github.com/yaklang/hack-skills (2601 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-09-13
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add yaklang/hack-skills --skill cors-cross-origin-misconfiguration -g -a claude-code -y`
Codex: `npx skills add yaklang/hack-skills --skill cors-cross-origin-misconfiguration -g -a codex -y`
Cursor: `npx skills add yaklang/hack-skills --skill cors-cross-origin-misconfiguration -g -a cursor -y`
Gemini CLI: `npx skills add yaklang/hack-skills --skill cors-cross-origin-misconfiguration -g -a gemini-cli -y`

## Description

CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, and browser-based access to authenticated APIs.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# SKILL: CORS Misconfiguration, Credentialed Origins, Reflection, and Trust Boundary Errors

> **AI LOAD INSTRUCTION**: Use this skill when browsers can access authenticated APIs cross-origin. Focus on reflected origins, credentialed requests, wildcard trust, parser mistakes, and origin allowlist bypasses. For JSONP hijacking deep dives, same-origin policy internals, honeypot de-anonymization, and CORS vs JSONP comparison, load the companion [SCENARIOS.md](./SCENARIOS.md).

### Extended Scenarios

Also load [SCENARIOS.md](./SCENARIOS.md) when you need:
- JSONP hijacking complete attack scenario, watering hole + `<script>` cross-origin data theft
- Honeypot de-anonymization via JSONP, use social platform JSONP endpoints to identify anonymous visitors
- Same-origin policy deep dive, protocol/hostname/port definition, `document.domain` subdomain relaxation and its security risks
- CORS vs JSONP technical comparison, methods, error handling, credential behavior, migration path
- CORS exploitation payloads, reflected origin with `credentials: include`, null origin via sandboxed iframe
- Dual-site attack lab pattern, localhost:8981 (target) + localhost:8982 (attacker) testing setup

## 1. WHEN TO LOAD THIS SKILL

Load when:

- Responses contain `Access-Control-Allow-Origin`, `Access-Control-Allow-Credentials`, or preflight headers
- A browser-based attack path might read authenticated API responses
- JSON endpoints appear protected from CSRF but are readable cross-origin

## 2. HIGH-VALUE MISCONFIGURATION CHECKS

The rest: https://github.com/yaklang/hack-skills/blob/HEAD/skills/cors-cross-origin-misconfiguration/SKILL.md