用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-clnt-07命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
正在显示 SKILL.md
| name | wstg-clnt-07 |
| description | Testing for Cross-Origin Resource Sharing (CORS) |
| category | client-side |
| owasp_id | WSTG-CLNT-07 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["client-side","javascript","dom","cors","wstg","clnt"] |
| tech_stack | ["cors","javascript"] |
| cwe_ids | ["CWE-942"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-CLNT-07
Testing for Cross-Origin Resource Sharing (CORS)
CORS is a browser mechanism that allows controlled access to resources from different origins. Misconfigured CORS policies can allow malicious websites to read sensitive data from authenticated users, leading to data theft.
#!/bin/bash
TARGET="https://target.com/api/user"
# Test with attacker origin
curl -sI -H "Origin: https://evil.com" "$TARGET" | grep -i "access-control"
# Test with null origin
curl -sI -H "Origin: null" "$TARGET" | grep -i "access-control"
# Test with subdomain
curl -sI -H "Origin: https://sub.target.com" "$TARGET" | grep -i "access-control"
# Test reflection
curl -sI -H "Origin: https://target.com.evil.com" "$TARGET" | grep -i "access-control"
<!-- Host this on attacker.com -->
<!DOCTYPE html>
<html>
<>
#!/usr/bin/env python3
import requests
class CORSTester:
def __init__(self, url):
self.url = url
self.findings = []
def test_cors(self):
"""Test CORS configuration"""
print(f"[*] Testing CORS on {self.url}")
test_origins = [
("https://evil.com", "Arbitrary origin"),
("null", "Null origin"),
("https://target.com.evil.com", "Suffix match bypass"),
("https://eviltarget.com", "Prefix/suffix confusion"),
]
for origin, description in test_origins:
headers = {"Origin": origin}
response = requests.get(self.url, headers=headers)
acao = response.headers.get("Access-Control-Allow-Origin", "")
acac = response.headers.get("Access-Control-Allow-Credentials", "")
if origin in acao or acao == "*":
severity = "High" if acac.lower() == "true" else "Medium"
print(f"[VULN] {description}: ACAO={acao}, ACAC={acac}")
self.findings.append({
"origin": origin,
"description": description,
"acao": acao,
"credentials": acac,
"severity": severity
})
def generate_report(self):
print("\n" + "="*50)
print("CORS SECURITY REPORT")
print("="*50)
if not self.findings:
print("\nNo CORS issues found.")
else:
for f in self.findings:
print(f"\n[{f['severity']}] {f['description']}")
print(f" Origin: {f['origin']}")
print(f" ACAO: {f['acao']}")
# Usage
tester = CORSTester("https://target.com/api/user")
tester.test_cors()
tester.generate_report()
# Proper CORS configuration
ALLOWED_ORIGINS = ['https://trusted.com', 'https://app.trusted.com']
@app.after_request
def add_cors_headers(response):
origin = request.headers.get('Origin')
if origin in ALLOWED_ORIGINS:
response.headers['Access-Control-Allow-Origin'] = origin
response.headers['Access-Control-Allow-Credentials'] = 'true'
response.headers['Access-Control-Allow-Methods'] = 'GET, POST, OPTIONS'
response.headers['Access-Control-Allow-Headers'] = 'Content-Type, Authorization'
return response
| Finding | CVSS | Severity |
|---|---|---|
| CORS with credentials + arbitrary origin | 8.1 | High |
| Wildcard CORS without credentials | 5.3 | Medium |
| null origin accepted | 6.5 | Medium |
| CWE ID | Title |
|---|---|
| CWE-942 | Permissive Cross-domain Policy with Untrusted Domains |
[ ] CORS headers analyzed
[ ] Arbitrary origins tested
[ ] null origin tested
[ ] Credentials header checked
[ ] PoC created if vulnerable
[ ] Findings documented