Identifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during security assessments.

Testing CORS Misconfiguration When to Use During authorized penetration tests when assessing API endpoints for cross origin access controls When testing single page applications that make cross origin API requests For evaluating whether sensitive data can be exfiltrated from a victim's browser session When assessing microservice architectures with multiple domains sharing data During security audits of applications using CORS headers for cross domain communication Prerequisites Authorization : Written penetration testing agreement for the target Burp Suite Professional : For intercepting and modifying Origin headers Browser with DevTools : For observing CORS behavior in real browser context Attacker web server : For hosting CORS exploitation PoC pages curl : For manual CORS header testing Python HTTP server : For hosting exploit pages locally Workflow Step 1: Identify CORS Configuration on Target Endpoints Check all API endpoints for CORS response headers. Step 2: Test Origin Reflection and Validation Bypass Determine how the server validates the Origin header. Step 3: Test Preflight Request Handling Assess how the server handles OPTIONS preflight requests. Step 4: Craft CORS Exploitation Proof of Concept Build an HTML page that exploits the CORS misconfiguration to steal data. Step 5: Exploit Null Origin Vulnerability If Origin: null is allowed, exploit via sandboxed iframes. Step 6: Test for Internal Network Access via CORS Check if CORS allows access from internal origins that could be leveraged via XSS. Key Concepts Concept Description Same Origin Policy Browser security model preventing scripts from one origin accessing data from another CORS Mechanism allowing servers to specify which origins can access their resources Origin Reflection Server mirrors the request Origin header in the ACAO response header (dangerous) Null Origin Special origin value from sandboxed iframes, data URIs, and redirects Preflight Request OPTIONS request sent before certain cross origin requests to check permissions Credentialed Requests Cross origin requests that include cookies, requiring explicit ACAO + ACAC headers Wildcard CORS Access Control Allow Origin: allows any origin but prohibits credentials Tools & Systems Tool Purpose Burp Suite Professional Intercepting requests and modifying Origin headers CORScanner Automated CORS misconfiguration scanner ( pip install corscanner ) cors scanner Node.js based CORS testing tool Browser DevTools Monitoring CORS errors and network requests in real browser context Python http.server Hosting CORS exploit PoC pages OWASP ZAP Automated CORS misconfiguration detection Common Scenarios Scenario 1: Full Origin Reflection The API reflects any Origin header in Access Control Allow Origin with Access Control Allow Credentials: true . Any website can read authenticated API responses, stealing user data. Scenario 2: Null Origin Allowed The server allows Origin: null with credentials. Using a sandboxed iframe, an attacker page sends credentialed requests to the API and reads the response data. Scenario 3: Subdomain Wildcard Trust The CORS policy allows .target.example.com . An attacker finds XSS on forum.target.example.com and uses it to make cross origin requests to api.target.example.com , stealing user data through the trusted subdomain. Scenario 4: Regex Bypass on Origin Validation The server uses regex target\.example\.com to validate origins, but fails to anchor the regex. attackertarget.example.com matches and is allowed access. Output Format

testing-cors-misconfiguration