Cross-Origin Resource Sharing (CORS) is a critical security mechanism that allows web applications to request resources from different domains. However, misconfigured CORS policies can expose your application to serious security vulnerabilities. Today, I’m excited to share a powerful tool called cors – a dedicated CORS misconfiguration scanner that helps security professionals and developers identify and fix these vulnerabilities.
What is CORS Misconfiguration Scanner?
GitHub: https://github.com/yogsec/cors
The cors tool is a fast, efficient command-line utility designed to detect CORS misconfigurations in web applications. Created by yogsec, this open-source tool helps you identify potential security loopholes before attackers can exploit them.
Key Features
- Single URL Scanning: Test individual endpoints quickly
- Bulk URL Scanning: Process multiple URLs from a wordlist
- Multi-threaded Support: Configure concurrent threads for faster scanning
- Custom Output: Save results to a file for later analysis
- User-Friendly Interface: Clear output with vulnerability indicators
Understanding CORS Vulnerabilities
The tool checks for common CORS misconfigurations including:
- Wildcard (*) in ACAO: Server accepts requests from any origin
- Origin Reflection: Server echoes back the Origin header
- Unsafe HTTP Methods: Allow dangerous methods like PUT/DELETE
- Wildcard in ACAH: All headers are permitted
- Credentials Enabled: Server allows sending credentials with requests
Installation Guide
Automatic Installation (Recommended)
git clone https://github.com/yogsec/cors
cd cors
sudo chmod +x install.sh
sudo ./install.sh
Enter fullscreen mode Exit fullscreen mode
Manual Installation
git clone https://github.com/yogsec/cors
cd cors
chmod +x cors
sudo cp cors /usr/local/bin/
Enter fullscreen mode Exit fullscreen mode
Verify Installation
cors -v
Enter fullscreen mode Exit fullscreen mode
Expected output: cors version: 1.0
How to Use
Basic Syntax
cors [OPTIONS]
Enter fullscreen mode Exit fullscreen mode
Usage Examples
1. Scan a Single URL
cors -u https://example.com
Enter fullscreen mode Exit fullscreen mode
Output example:
[*] Checking: https://example.com
[!] https://example.com - Reflects origin in ACAO
[!] https://example.com - Credentials enabled
Enter fullscreen mode Exit fullscreen mode
2. Scan Multiple URLs
Create a file urls.txt:
https://example.com
https://test.com/api
https://target.com
Enter fullscreen mode Exit fullscreen mode
Run the scan:
cors -w urls.txt
Enter fullscreen mode Exit fullscreen mode
3. Save Results to a File
cors -w urls.txt -o results.txt
Enter fullscreen mode Exit fullscreen mode
4. Increase Scanning Speed
cors -w urls.txt -c 20
Enter fullscreen mode Exit fullscreen mode
5. Combine Multiple Options
cors -w urls.txt -o vulnerable.txt -c 30
Enter fullscreen mode Exit fullscreen mode
Get Involved
- GitHub Repository: https://github.com/yogsec/cors
- Report Issues: GitHub Issues
- Contribute: Fork the repository and submit pull requests
Why This Tool Matters
In today’s web application landscape, CORS misconfigurations are among the most common and dangerous security vulnerabilities. This tool provides:
- Quick Identification: Rapidly detect potential CORS issues
- Automated Testing: Streamline your security testing process
- Comprehensive Coverage: Test multiple URLs and configurations
- Developer-Friendly: Easy to use with clear output