domains / families / security / hunt-cors

hunt-cors

authentic

Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled origin can perform a CREDENTIALED cross-origin read of sensitive data and you have proven it in a browser. Use when testing API endpoints, SPAs, or any app emitting Access-Control-* headers.

When to use

• origin-reflection with credentials
• null-origin trust
• subdomain-regex bypass
• pre-flight (OPTIONS) gating bypass
• postMessage origin checks
• testing API endpoints
• testing SPAs
• testing apps emitting Access-Control-* headers

When not to use

• header-diffing alone
• wildcard-only endpoints without sensitive unauthenticated data

Skill page

Source