CORS Misconfiguration Scanner#

Scan web endpoints for dangerous Cross-Origin Resource Sharing policies. Detect misconfigurations that could allow attackers to steal data cross-origin.

Quick Scan#

bash

python3 scripts/cors_scan.py https://api.example.com

Batch Scan#

bash

python3 scripts/cors_scan.py https://api1.com https://api2.com https://api3.com

Output Formats#

bash

# Text (default)
python3 scripts/cors_scan.py <url>

# JSON
python3 scripts/cors_scan.py <url> --format json

# Markdown report
python3 scripts/cors_scan.py <url> --format markdown

CI/CD Integration#

bash

# Fail if any URL grades below C
python3 scripts/cors_scan.py https://api.example.com --min-grade C
echo $?  # 0 = pass, 1 = fail

What It Checks (13 checks)#

CheckSeverityDescriptionOrigin reflectionCritical/HighServer reflects arbitrary Origin back as ACAOCredentials + wildcardCriticalACAO: * with ACAC: true (browser-blocked but misconfigured)Null origin acceptedHigh/MediumOrigin: null trusted (exploitable via sandboxed iframes)HTTP origin on HTTPSHighHTTPS endpoint trusts HTTP origins (MitM risk)Subdomain wildcardHighTrusts any subdomain (*.domain.com)Third-party originHighConfirms reflection with different attacker domainPrivate network accessHighAllows external sites to reach internal networkWildcard origin (*)MediumACAO: * on potentially sensitive endpointsSensitive headers exposedMediumExposes auth/session headers cross-originWildcard methodsMediumACAM: * allows any HTTP methodWildcard headersMediumACAH: * allows any custom headerMissing max-ageLowNo preflight caching, increased latencyCleanInfoNo misconfigurations detected

Grading#

GradeMeaningANo CORS issues detectedBMinor issues (low severity)CModerate issues (medium severity)DSerious issues (high severity or multiple medium)FCritical misconfigurations (origin reflection + credentials)

Requirements#

• Python 3.6+
• No external dependencies (stdlib only)

Examples#

text

$ python3 scripts/cors_scan.py https://httpbin.org/get
CORS Scan: https://httpbin.org/get
Grade: A
Findings: 0
============================================================

⚪ [INFO] No CORS misconfigurations detected
  The scanned endpoint does not appear to have dangerous CORS policies.