hunt-cors

# HUNT-CORS — Cross-Origin Resource Sharing Misconfiguration ## What actually pays (and what does not) CORS pays High **only** when an attacker-controlled origin can perform a **credentialed** cross-origin read of sensitive authenticated data, and you have a browser PoC proving the response body is readable from `evil.com`. Two hard browser rules that kill most "findings" — check these FIRST: - **`Access-Control-Allow-Origin: *` CANNOT be combined with credentials.** If the server returns `ACAO: *`, the browser refuses to send/expose the response for a `credentials: include` request. A wildcard-only endpoint is **not** credential-exploitable. It is only interesting if the data it serves is sensitive *without* a session (rare) — usually this is Informational/Low. - **`Access-Control-Allow-Credentials: true` is meaningless on its own.** It matters only if `ACAO` reflects/allows your specific attacker origin AND a cross-origin credentialed `fetch` actually returns a readable body. ACAC on a response that does not reflect your origin proves nothing. If you cannot demonstrate a readable cross-origin authed body in a real browser, you do not have a High. Do not submit header-diffing alone. --- ## Crown Jewel Targets - **Reflect-any-origin + credentials** — server echoes the `Origin` header AND sets `ACAC: true` → any site reads authed API responses. The classic High. - **Null-origin trust** — `ACAO: null` + `ACAC: true`. A `sandbox` iframe (or a `data:`/re...