<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Testing CORS Misconfiguration

## curl — Manual CORS Testing
```bash
# Test origin reflection
curl -s -I -H "Origin: https://evil.com" https://target.com/api/endpoint

# Test null origin
curl -s -I -H "Origin: null" https://target.com/api/endpoint

# Test with credentials
curl -s -H "Origin: https://evil.com" -H "Cookie: session=TOKEN" \
  https://target.com/api/endpoint -D-
```

## nuclei — Automated CORS Scanning
```bash
nuclei -u https://target.com -t http/misconfiguration/cors/ -json
nuclei -l urls.txt -t http/misconfiguration/cors/ -o results.json
```

## corsy — Dedicated CORS Scanner
```bash
corsy -u https://target.com/api/endpoint
corsy -i urls.txt -t 20 -o cors_results.json
```
