<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: testing-cors-misconfiguration
description: >-
  Identify and exploit Cross-Origin Resource Sharing misconfigurations
  including wildcard origins, null origin reflection, credential leakage,
  and overly permissive access-control headers that enable cross-origin
  data theft and CSRF bypass.
domain: cybersecurity
subdomain: application-security
tags:
  - cors
  - cross-origin
  - same-origin-policy
  - access-control
  - owasp-a05
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1189", "T1557"]
  owasp-top10: ["A05"]
  tools: ["curl", "burpsuite", "nuclei", "corsy"]
---

# Testing CORS Misconfiguration

## Overview

CORS misconfigurations allow attackers to bypass the Same-Origin Policy,
enabling cross-origin data theft from authenticated sessions. Common flaws
include reflecting arbitrary origins, allowing null origin, wildcards with
credentials, and trusting subdomains vulnerable to takeover.

## Prerequisites

- Tools: curl, Burp Suite, nuclei, corsy
- Target URL with authenticated endpoints
- Browser with developer tools

## Workflow

### Step 1: Enumerate CORS Headers

```bash
# Test basic CORS reflection
curl -s -I -H "Origin: https://evil.com" https://target.com/api/user | \
  grep -i 'access-control'

# Test null origin reflection
curl -s -I -H "Origin: null" https://target.com/api/user | \
  grep -i 'access-control'

# Test subdomain reflection
curl -s -I -H "Origin: https://sub.target.com" https://target.com/api/user | \
  grep -i 'access-control'

# Test prefix match bypass
curl -s -I -H "Origin: https://target.com.evil.com" https://target.com/api/user | \
  grep -i 'access-control'
```

### Step 2: Automated Scanning

```bash
# Nuclei CORS templates
nuclei -u https://target.com -t http/misconfiguration/cors/ -json

# Corsy bulk scan
corsy -i urls.txt -t 20 -o cors_results.json
```

### Step 3: Exploit Validation

```bash
# Test with credentials flag
curl -s -H "Origin: https://evil.com" -H "Cookie: session=TOKEN" \
  https://target.com/api/user -D- | \
  grep -E 'access-control-allow-(origin|credentials)'
```

### Step 4: Check Preflight Handling

```bash
# OPTIONS preflight request
curl -s -X OPTIONS \
  -H "Origin: https://evil.com" \
  -H "Access-Control-Request-Method: PUT" \
  -H "Access-Control-Request-Headers: X-Custom" \
  https://target.com/api/user -D- | grep -i 'access-control'
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Reflected Origin header | WAF logs | Access-Control-Allow-Origin echoes request Origin |
| Credentials with wildcard | Response headers | Allow-Credentials: true with broad origins |
| Null origin accepted | Access logs | Requests with Origin: null succeeding |

```yaml
title: Testing Cors Misconfiguration Detection
id: ed8b76bb-829c-4662-8780-be294c6231fa
status: experimental
description: Detects suspicious activity related to testing cors misconfiguration techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1189
  - attack.t1557
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] All API endpoints tested for origin reflection
- [ ] Null origin handling verified
- [ ] Subdomain trust validated against takeover risk
- [ ] Preflight responses checked for overly permissive methods
- [ ] PoC demonstrates cross-origin data access

## References

- [PortSwigger CORS Research](https://portswigger.net/research/exploiting-cors-misconfigurations-for-bitcoins-and-bounties)
- [OWASP CORS Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
- [MDN CORS Documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
