hunt-cors

1# HUNT-CORS — Cross-Origin Resource Sharing Misconfiguration
2 
3## What actually pays (and what does not)
4 
5CORS pays High **only** when an attacker-controlled origin can perform a
6**credentialed** cross-origin read of sensitive authenticated data, and you
7have a browser PoC proving the response body is readable from `evil.com`.
8 
9Two hard browser rules that kill most "findings" — check these FIRST:
10 
11- **`Access-Control-Allow-Origin: *` CANNOT be combined with credentials.**
12  If the server returns `ACAO: *`, the browser refuses to send/expose the
13  response for a `credentials: include` request. A wildcard-only endpoint is
14  **not** credential-exploitable. It is only interesting if the data it serves
15  is sensitive *without* a session (rare) — usually this is Informational/Low.
16- **`Access-Control-Allow-Credentials: true` is meaningless on its own.** It
17  matters only if `ACAO` reflects/allows your specific attacker origin AND a
18  cross-origin credentialed `fetch` actually returns a readable body. ACAC on a
19  response that does not reflect your origin proves nothing.
20 
21If you cannot demonstrate a readable cross-origin authed body in a real
22browser, you do not have a High. Do not submit header-diffing alone.
23 
24---
25 
26## Crown Jewel Targets
27 
28- **Reflect-any-origin + credentials** — server echoes the `Origin` header AND
29  sets `ACAC: true` → any site reads authed API responses. The classic High.
30- **Null-origin trust** — `ACAO: null` + `ACAC: true`. A `sandbox` iframe (or a
31…