elementalsouls/Claude-BugHunter✦ 精选0°

hunt-cors

仓库创建 2026年5月5日最近提交 4 天前SkillHot 收录 20 天前

⬈ GitHub 仓库 ⬈ SKILL.md 原文件 ⬇ Raw 原始文件

▸ 精选理由

定位能导致凭证化跨域读取的高价值漏洞。

▸ 风险提示

含攻击与漏洞利用内容，禁止未授权使用

这个 Skill 做什么

检测并利用不安全的 CORS 配置以识别凭证化跨域读取风险。

检测不安全的 CORS 配置：origin 反射携带凭证、信任 null origin、子域名正则绕过等，目标是能否让攻击者控制的域在浏览器里带着 cookie 做到 credentialed 的跨域读取。适合测试 API、SPA 或任何会返回 Access-Control-* 头的服务。关键点是只有能在浏览器里证明读取到带凭证的响应体才是真正高价值的发现。

▸ 展开 SKILL.md 英文原文

Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled origin can perform a CREDENTIALED cross-origin read of sensitive data and you have proven it in a browser. Use when testing API endpoints, SPAs, or any app emitting Access-Control-* headers.

开发编程CORS浏览器凭证化跨域通用

3.1k

Stars

480

Forks

仓库内 Skill

+245

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-cors/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-cors/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# HUNT-CORS — Cross-Origin Resource Sharing Misconfiguration

## What actually pays (and what does not)

CORS pays High **only** when an attacker-controlled origin can perform a
**credentialed** cross-origin read of sensitive authenticated data, and you
have a browser PoC proving the response body is readable from `evil.com`.

Two hard browser rules that kill most "findings" — check these FIRST:

- **`Access-Control-Allow-Origin: *` CANNOT be combined with credentials.**
  If the server returns `ACAO: *`, the browser refuses to send/expose the
  response for a `credentials: include` request. A wildcard-only endpoint is
  **not** credential-exploitable. It is only interesting if the data it s

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有