Vulnerabilities
Surface permissive Origin handling across live endpoints
Find Cross-Origin Resource Sharing misconfigurations on a URL list.
overview
What corstest does
CORStest sends crafted Origin headers against a file of URLs or domains and reads Access-Control responses. It flags reflecting any origin, trusting null, and other loose policies that let a foreign page read a target response.
Use -q to keep output on the high-value case: allow-credentials with a permissive origin. Pass -c name=value when the misconfig only appears for an authenticated session. Raise -p above the default 32 workers on large lists.
Wire it after httpx or a crawler that already proved hosts respond. It writes a file and a folder. Pair with nuclei for broader web checks; keep CORStest when the question is CORS-only breadth.
source github.com/RUB-NDS/CORStest
use cases
Where corstest fits
Scan endpoints for CORS flaws
Send crafted Origin headers across a URL list to find hosts that reflect arbitrary origins or trust null, leaking cross-origin data.
Focus on the dangerous case
Use quiet mode to surface only endpoints that allow credentials with a permissive origin, the combination that exposes data.
Test authenticated responses
Send a session cookie with every request so corstest catches misconfigurations that only appear for logged-in users.
Sweep many hosts at once
Pass a file of URLs and raise the process count so a single run checks CORS across a wide surface in parallel.
reference
corstest inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| infile | FILE | · | URLs/domains to scan |
| quiet | BOOLEAN | -q | quiet, allow-credentials only |
| cookies | STRING | -c | Send cookie with all requests (name=value) |
| processes | STRING | -p | multiprocessing (default: 32) |
| verbose | BOOLEAN | -v | produce a more verbose output |
Showing key inputs. corstest exposes 5 inputs in total.
example
Run corstest
# quiet CORS check across a URL list, 32 workerscorstest.py -q -p 32 urls.txt # authenticated sweep with a session cookiecorstest.py -c 'session=abc123' -v urls.txt[*] https://example.com/ (reflect)[*] https://api.example.com/v1/me (reflect+creds)[*] https://app.example.com/profile (null origin)[*] https://staging.example.com/ (reflect)[*] https://example.com/api/user (reflect+creds)[*] https://www.example.com/account (null origin)[*] https://cdn.example.com/ (no CORS)guidance
Choosing corstest
Use CORStest when you have a URL set and need to know which hosts expose data through a loose CORS policy. Feed endpoints a crawler or prober already surfaced. For broad template coverage beyond CORS, use nuclei.
corsy
Another CORS misconfiguration scanner. CORStest centers on a URL file and multiprocess workers.
nuclei
Broad template scanner with some CORS checks. CORStest is the focused parallel CORS pass.
httpx
Probes hosts and emits live URLs. Run it first, then feed CORStest the responding endpoints.
faq
corstest questions
related
More Vulnerabilities tools
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
commix
Automates OS command injection detection and exploitation.
dalfox
Parameter mining and XSS testing with headless verification.
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
Run corstest yourself
A URL list is probed by httpx, then CORStest checks the live endpoints for CORS misconfigurations and writes the findings as output.
Facts on this page come from the live Trickest tool library.