Corsy is a lightweight program that scans for all known misconfigurations in CORS implementations.
Using Corsy is pretty simple
python corsy.py -u https://example.com
A delay between consecutive requests can be specified with -d option.
Note: This is a beta version, features such as JSON output and scanning multiple hosts will be added later.
- Pre-domain bypass
- Post-domain bypass
- Backtick bypass
- Null origin bypass
- Invalid value
- Wild card value
- Origin reflection test
- Third party allowance test
- HTTP allowance test
Liked the project? Donate a few bucks to motivate me to keep writing code for free.
- Paypal - https://paypal.me/s0md3v
- Credit/Debit Card - https://www.buymeacoffee.com/s0md3v
./multiple_targets.sh target/target
create your target file in the target folder without https://
- added init.py file in utils folder
- now corsy.py prints the current target from the script