loading
Loading content
loading
Vulnerabilities
Find Cross-Origin Resource Sharing misconfigurations on a URL list.
overview
CORStest sends crafted Origin headers against a file of URLs or domains and reads Access-Control responses. It flags reflecting any origin, trusting null, and other loose policies that let a foreign page read a target response.
Use -q to keep output on the high-value case: allow-credentials with a permissive origin. Pass -c name=value when the misconfig only appears for an authenticated session. Raise -p above the default 32 workers on large lists.
Wire it after httpx or a crawler that already proved hosts respond. It writes a file and a folder. Pair with nuclei for broader web checks; keep CORStest when the question is CORS-only breadth.
source github.com/RUB-NDS/CORStest
use cases
Send crafted Origin headers across a URL list to find hosts that reflect arbitrary origins or trust null, leaking cross-origin data.
Use quiet mode to surface only endpoints that allow credentials with a permissive origin, the combination that exposes data.
Send a session cookie with every request so corstest catches misconfigurations that only appear for logged-in users.
Pass a file of URLs and raise the process count so a single run checks CORS across a wide surface in parallel.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| infile | FILE | · | URLs/domains to scan |
| quiet | BOOLEAN | -q | quiet, allow-credentials only |
| cookies | STRING | -c | Send cookie with all requests (name=value) |
| processes | STRING | -p | multiprocessing (default: 32) |
| verbose | BOOLEAN | -v | produce a more verbose output |
Showing key inputs. corstest exposes 5 inputs in total.
example
# quiet CORS check across a URL list, 32 workerscorstest.py -q -p 32 urls.txt # authenticated sweep with a session cookiecorstest.py -c 'session=abc123' -v urls.txt[*] https://example.com/ (reflect)[*] https://api.example.com/v1/me (reflect+creds)[*] https://app.example.com/profile (null origin)[*] https://staging.example.com/ (reflect)[*] https://example.com/api/user (reflect+creds)[*] https://www.example.com/account (null origin)[*] https://cdn.example.com/ (no CORS)guidance
Use CORStest when you have a URL set and need to know which hosts expose data through a loose CORS policy. Feed endpoints a crawler or prober already surfaced. For broad template coverage beyond CORS, use nuclei.
Another CORS misconfiguration scanner. CORStest centers on a URL file and multiprocess workers.
Broad template scanner with some CORS checks. CORStest is the focused parallel CORS pass.
Probes hosts and emits live URLs. Run it first, then feed CORStest the responding endpoints.
faq
related
Automates OS command injection detection and exploitation.
Subdomain takeover scanner with cloud-zone intake.
Locate public CVE proof-of-concept repositories on GitHub.
Decode, forge, crack, and tamper JWTs for auth checks.
Triage reflected special characters on parameterized URLs.
Detect and exploit SQL injection on authorized web targets.
A URL list is probed by httpx, then CORStest checks the live endpoints for CORS misconfigurations and writes the findings as output.
Facts on this page come from the live Trickest tool library.