🎁 Get the FREE AI Skills Starter Guide β€” Subscribe β†’
BytesAgainBytesAgain
BytesAgain β€Ί Skills β€Ί CORS Scanner
πŸ¦€ ClawHub

CORS Scanner

by @charlie-morrison

Scan web endpoints for CORS misconfigurations. Detect origin reflection, wildcard policies, null origin acceptance, credential leaks, subdomain trust, HTTP o...

Versionv1.0.1
Downloads473
#requires-sensitive-credentials#clawhub
TERMINAL
clawhub install cors-scanner

πŸ“– About This Skill

name: cors-scanner description: Scan web endpoints for CORS misconfigurations. Detect origin reflection, wildcard policies, null origin acceptance, credential leaks, subdomain trust, HTTP origin trust on HTTPS, preflight issues, and private network access. Assign A-F security grades. Use when asked to check CORS, test cross-origin policy, audit CORS headers, scan for CORS vulnerabilities, or check if an API has safe CORS configuration. Triggers on "CORS", "cross-origin", "CORS misconfiguration", "CORS scan", "Access-Control-Allow-Origin", "origin reflection".

CORS Misconfiguration Scanner

Scan web endpoints for dangerous Cross-Origin Resource Sharing policies. Detect misconfigurations that could allow attackers to steal data cross-origin.

Quick Scan

python3 scripts/cors_scan.py https://api.example.com

Batch Scan

python3 scripts/cors_scan.py https://api1.com https://api2.com https://api3.com

Output Formats

# Text (default)
python3 scripts/cors_scan.py 
JSON

python3 scripts/cors_scan.py  --format json
Markdown report

python3 scripts/cors_scan.py  --format markdown

CI/CD Integration

# Fail if any URL grades below C
python3 scripts/cors_scan.py https://api.example.com --min-grade C
echo $?  # 0 = pass, 1 = fail

What It Checks (13 checks)

| Check | Severity | Description | |-------|----------|-------------| | Origin reflection | Critical/High | Server reflects arbitrary Origin back as ACAO | | Credentials + wildcard | Critical | ACAO: * with ACAC: true (browser-blocked but misconfigured) | | Null origin accepted | High/Medium | Origin: null trusted (exploitable via sandboxed iframes) | | HTTP origin on HTTPS | High | HTTPS endpoint trusts HTTP origins (MitM risk) | | Subdomain wildcard | High | Trusts any subdomain (*.domain.com) | | Third-party origin | High | Confirms reflection with different attacker domain | | Private network access | High | Allows external sites to reach internal network | | Wildcard origin (*) | Medium | ACAO: * on potentially sensitive endpoints | | Sensitive headers exposed | Medium | Exposes auth/session headers cross-origin | | Wildcard methods | Medium | ACAM: * allows any HTTP method | | Wildcard headers | Medium | ACAH: * allows any custom header | | Missing max-age | Low | No preflight caching, increased latency | | Clean | Info | No misconfigurations detected |

Grading

| Grade | Meaning | |-------|---------| | A | No CORS issues detected | | B | Minor issues (low severity) | | C | Moderate issues (medium severity) | | D | Serious issues (high severity or multiple medium) | | F | Critical misconfigurations (origin reflection + credentials) |

Requirements

  • Python 3.6+
  • No external dependencies (stdlib only)

    • Examples

    $ python3 scripts/cors_scan.py https://httpbin.org/get
CORS Scan: https://httpbin.org/get
Grade: A
Findings: 0
============================================================
    βšͺ [INFO] No CORS misconfigurations detected
  The scanned endpoint does not appear to have dangerous CORS policies.

    πŸ’‘ Examples

    $ python3 scripts/cors_scan.py https://httpbin.org/get
CORS Scan: https://httpbin.org/get
Grade: A
Findings: 0
============================================================
    βšͺ [INFO] No CORS misconfigurations detected
  The scanned endpoint does not appear to have dangerous CORS policies.