Cors Cross Origin Misconfiguration

This is a systematic playbook for catching CORS misconfigurations that let attackers read authenticated API responses from a victim's browser. It covers the usual suspects: reflected origins, null origin acceptance, weak regex allowlists, and the missing Vary header that can poison CDN caches. The null origin exploitation via sandboxed iframes is especially clean, and the subdomain XSS to CORS chain section shows how a single XSS on blog.target.com can break into api.target.com if the allowlist trusts *.target.com. Load this when you see Access-Control headers in responses or need to test whether browser-based attacks can exfiltrate sensitive data cross-origin. The regex bypass table alone will save you time.

skills.sh installs: 3.9K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill cors-cross-origin-misconfiguration --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: CORS Misconfiguration — Credentialed Origins, Reflection, and Trust Boundary Errors

AI LOAD INSTRUCTION: Use this skill when browsers can access authenticated APIs cross-origin. Focus on reflected origins, credentialed requests, wildcard trust, parser mistakes, and origin allowlist bypasses. For JSONP hijacking deep dives, same-origin policy internals, honeypot de-anonymization, and CORS vs JSONP comparison, load the companion SCENARIOS.md.