domains / families / security / cors-chain-automation

cors-chain-automation

separate

Use when a bounded list of authorized API endpoints needs consistent CORS triage before browser validation.

When to use

• Use when you have a list of API endpoints or target domains and need to systematically find credential-exploitable CORS misconfigurations at scale. Distinguishes the 3 exploitable patterns (reflect-any-origin + credentials, null-origin tru…

When not to use

• ACAO: * alone
• ACAC without reflected origin
• same-origin-only

Skill page

Source