Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Based on SOC occupation classification
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-clnt-07The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
| name | wstg-clnt-07 |
| description | Testing for Cross-Origin Resource Sharing (CORS) |
| category | client-side |
| owasp_id | WSTG-CLNT-07 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["client-side","javascript","dom","cors","wstg","clnt"] |
| tech_stack | ["cors","javascript"] |
| cwe_ids | ["CWE-942"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-CLNT-07
Testing for Cross-Origin Resource Sharing (CORS)
CORS is a browser mechanism that allows controlled access to resources from different origins. Misconfigured CORS policies can allow malicious websites to read sensitive data from authenticated users, leading to data theft.
#!/bin/bash
TARGET="https://target.com/api/user"
# Test with attacker origin
curl -sI -H "Origin: https://evil.com" "$TARGET" | grep -i "access-control"
# Test with null origin
curl -sI -H "Origin: null" "$TARGET" | grep -i "access-control"
# Test with subdomain
curl -sI -H "Origin: https://sub.target.com" "$TARGET" | grep -i "access-control"
# Test reflection
curl -sI -H "Origin: https://target.com.evil.com" "$TARGET" | grep -i "access-control"
<!-- Host this on attacker.com -->
<!DOCTYPE html>
<html>
<>
#!/usr/bin/env python3
import requests
class CORSTester:
def __init__(self, url):
self.url = url
self.findings = []
def test_cors(self):
"""Test CORS configuration"""
print(f"[*] Testing CORS on {self.url}")
test_origins = [
("https://evil.com", "Arbitrary origin"),
("null", "Null origin"),
("https://target.com.evil.com", "Suffix match bypass"),
("https://eviltarget.com", "Prefix/suffix confusion"),
]
for origin, description in test_origins:
headers = {"Origin": origin}
response = requests.get(self.url, headers=headers)
acao = response.headers.get("Access-Control-Allow-Origin", "")
acac = response.headers.get("Access-Control-Allow-Credentials", "")
if origin in acao or acao == "*":
severity = "High" if acac.lower() == "true" else "Medium"
print(f"[VULN] {description}: ACAO={acao}, ACAC={acac}")
self.findings.append({
"origin": origin,
"description": description,
"acao": acao,
"credentials": acac,
"severity": severity
})
def generate_report(self):
print("\n" + "="*50)
print("CORS SECURITY REPORT")
print("="*50)
if not self.findings:
print("\nNo CORS issues found.")
else:
for f in self.findings:
print(f"\n[{f['severity']}] {f['description']}")
print(f" Origin: {f['origin']}")
print(f" ACAO: {f['acao']}")
# Usage
tester = CORSTester("https://target.com/api/user")
tester.test_cors()
tester.generate_report()
# Proper CORS configuration
ALLOWED_ORIGINS = ['https://trusted.com', 'https://app.trusted.com']
@app.after_request
def add_cors_headers(response):
origin = request.headers.get('Origin')
if origin in ALLOWED_ORIGINS:
response.headers['Access-Control-Allow-Origin'] = origin
response.headers['Access-Control-Allow-Credentials'] = 'true'
response.headers['Access-Control-Allow-Methods'] = 'GET, POST, OPTIONS'
response.headers['Access-Control-Allow-Headers'] = 'Content-Type, Authorization'
return response
| Finding | CVSS | Severity |
|---|---|---|
| CORS with credentials + arbitrary origin | 8.1 | High |
| Wildcard CORS without credentials | 5.3 | Medium |
| null origin accepted | 6.5 | Medium |
| CWE ID | Title |
|---|---|
| CWE-942 | Permissive Cross-domain Policy with Untrusted Domains |
[ ] CORS headers analyzed
[ ] Arbitrary origins tested
[ ] null origin tested
[ ] Credentials header checked
[ ] PoC created if vulnerable
[ ] Findings documented