CorsOne - CorsOne - Fast and comprehensive CORS misconfigura

项目说明

<di="center">
<h1>CorsOne</h1>
<b>Fast, Accurate, and Comprehensive CORS Misconfiguration Detection</b>

Features • Installation • Quick Start • Usage Guide • Examples • Tutorial
</div>

---

📋 Table of Contents

1. What is CorsOne?
2. Features
3. Performance Comparison
4. Installation
5. Quick Start
6. Usage Guide
7. CLI Options
8. Examples
9. Tutorial
10. Output Explanation
11. Contributing
12. Acknowledgment
13. License
14. De
15. Support
16. Additional Resources

---

What is CorsOne?

CorsOne is a specialized security testing tool designed to detect and identify Cross-Origin Resource Sharing (CORS) misconfigurations in web applications. It automates the process of testing for CORS that could allow attackers to:

Access sensitive data from authenticated users

Perform unauthorized actions on behalf of users

Bypass Same-Origin Policy (SOP) restrictions

Steal credentials and session tokens

Why CorsOne?

Unlike generic security scanners, CorsOne:

✅ Tests 40+ CORS bypass techniques automatically

✅ Provides accurate results with low false positives

✅ High-performance async scanning using asyncio and aiohttp

✅ DNS caching with aiodns for repeated hostname efficiency

✅ Easy integration - supports STDIN and file input

✅ Flexible customization - supports custom headers, proxies, and methods

✅ Color-coded output - easy to identify

✅ Docker support - no dependency installation needed

---

✨ Features

Core Features

Automatic CORS Misconfiguration Detection - Tests multiple bypass techniques

Multiple Input Methods

- Single URL with -u flag
- Multiple URLs from file with -l flag
- STDIN piping for easy integration

Customizable Origin Testing - Test with custom domains instead of default "attacker.com"

Custom Headers Support - Add authentication cookies and headers for protected endpoints

Flexible HTTP Methods - Support for GET, POST, PUT, DELETE, etc.

Rate Limiting - Control request frequency to avoid detection

Proxy Support - Route requests through HTTP/HTTPS proxies

Stop-on-First Detection - Exit immediately after finding first

Multiple Output Formats - TXT, JSON, and SARIF for ad reporting

Technical Features

No False Positives - Checks for both ACAO header and credentials flag

Async HTTP Engine - Built on aiohttp for non-blocking, concurrent requests

DNS Caching - Uses aiodns caching to reduce repeated hostname lookups

URL - Automatically and formats URLs

Color-Coded Output - Green for , red for not

Error Handling - Graceful handling of network errors and timeouts

SARIF Export - Standards-compliant security reporting format

Keyboard Interrupt Support - Safely cancel operations with Ctrl+C

Bypass Techniques Tested

1. Reflected Origin - Direct origin reflection
2. Breaking TLS - HTTP/HTTPS protocol mixing
3. Trusted Subdomains - Subdomain bypasses
4. Null Origin - Testing null origin header
5. Domain Ending Bypasses - character injections
6. Localhost Edge Cases - Localhost regex bypasses
7. Domain Separation Bypasses - 20+ with special characters
8. Ad Regexp Bypasses - Regex metacharacter injections

---

⚡ Performance Comparison

CorsOne has been significantly optimized for speed with a complete async HTTP refactor. The current uses asyncio and aiohttp with DNS caching for better throughput, lower latency, and reduced thread o.

Test Command: python3 CorsOne.py -u target.com -s

v0.9.8 (Previous ): ~5.5 seconds (real time)

v1.0.0 beta (Current ): ~0.8 seconds (real time)

Impro: Approximately 7x faster execution time, now powered by an async aiohttp engine and cached DNS resolution.

---

🚀 Installation

Option 1: Docker (Recommended - No Setup Required)

The easiest way to run CorsOne without installing dependencies:

> ⚠️ Note: The Docker image is currently una. Please use the alternati methods until it becomes accessible again.

Option 2: Quick Start with Python

Prerequisites

Python 3.7 or higher

pip (Python package manager)

git (for cloning the repository)

Installation Steps

Option 3: Install from Source Without En

---

⚡ Quick Start

Simplest Usage - Scan a Single URL

Scan Multiple URLs from a File

Pipe URLs from Another Tool

Quick Check

---

📖 Usage Guide

Basic Command Structure

Input Options

Single URL:

Multiple URLs from File:

From STDIN (Piped Input):

Output Options

Sa to File:

Specify Output Format (TXT, JSON, or SARIF):

Sa Logs:

Disable Color Output:

Customization Options

Custom Domain for Testing:

Custom HTTP Method:

Rate Limiting:

Proxy Support:

Stop on First :

Custom Headers:

---

🎯 CLI Options

| Option | Short | Type | Description | Default | Example |
|--------|-------|------|-------------|---------|---------|
| URL | -u | string | Target URL to scan | - | -u |
| List | -l | file | File containing URLs | - | -l targets.txt |
| Output | -o | file | Sa to file | - | -o results.txt |
| Format | -f | choice | Output format (txt/json/sarif) | txt | -f sarif |
| Headers | -H | string | Custom headers as JSON | - | -H '{"Cookie": "session=abc123"}' |
| Log | --log | file | Sa logs to file | - | --log scan.log |
| Only | -vo, -- | flag | Show and save only endpoints | false | -vo |
| No Color | -nc | flag | Disable colored output | false | -nc |
| Domain | -cd | string | Custom domain for testing | attacker.com | -cd attacker.com | <!-- FIX B1 -->
| Method | -m | string | HTTP method to use | GET | -m POST |
| Workers | -w | int | Concurrent workers | 5 | -w 10 |
| Rate Limit | -rl | float | Delay between requests (sec) | 0 | -rl 2 |
| Timeout | -t | int | Request timeout (seconds) | 10 | -t 15 |
| Retries | -r | int | Number of retries | 3 | -r 3 |
| Proxy | -p | string | HTTP/HTTPS proxy URL | - | -p |
| Stop on First | -sof | flag | Exit after first | false | -sof |
| | -v | flag | logging | false | -v |
| Silent | -s | flag | No banner output | false | -s |
| Help | -h | flag | Show help message | - | -h |
| | -- | flag | Show information | - | -- |

---

🔧 Examples

Example 1: Basic Single URL Scan

Example 2: Batch Scanning with File

Example 3: JSON Output for Automation

Example 3.5: SARIF Output for Ad Reporting

Example 4: Debug Logging

Example 5: Quick Check

Example 6: POST Request Scanning

Example 7: Using Proxy for Testing

Example 8: Integration with Other Tools

Example 9: Custom Headers (JSON Format)

Example 10: Using Docker with Options

---

📚 Tutorial

Tutorial 1: First Time Setup and Basic Scan

Step 1: Install Dependencies

Step 2: Run Your First Scan

Step 3: Understand the Output

---

Tutorial 2: Output Formats and Results Management

Scenario: You want to sa in specific format for automation or reporting

Step 1: JSON Output for Automation

Step 2: TXT Output for Reporting

Step 3: Enable Debug Logging

---

Tutorial 2: Scanning Multiple URLs and Saving Results

Step 1: Create a Target File

Step 2: Run Batch Scan

Step 3: Review Results

---

Tutorial 3: Ad Scanning with Custom Domains

Scenario: You want to test CORS with your own domain instead of "attacker.com"

Step 1: Prepare

Step 2: Run Scan with Custom Domain

Step 3: Analyze Results

---

Tutorial 4: Testing Cookie-Based Authenticated Endpoints

Scenario: Your target uses cookie-based authentication - test with custom headers

Step 1: Obtain Session Cookie

Step 2: Scan with Cookie Header (JSON Format)

Step 3: Analyze Results

---

Tutorial 5: Proxy-Based Testing (Burp Suite Integration)

Scenario: You want to intercept and inspect requests in Burp Suite

Step 1: Start Burp Suite


Launch Burp Suite

Go to Settings → Network → Proxy and note the port (usually 8080)

Step 2: Run CorsOne Through Proxy

Step 3: Inspect in Burp Suite

All requests will appear in Burp's Proxy → HTTP History

You can see the Origin headers being tested

Inspect responses for CORS headers

---

Tutorial 6: Rate-Limited Scanning (Avoid Detection)

Scenario: Target has rate limiting or IDS detection

Step 1: Identify Optimal Rate

Step 2: If Getting Blocked, Increase Delay

Step 3: Monitor for Rate Limit Errors

---

Tutorial 7: CORS Testing on Different HTTP Methods

Scenario: API supports multiple HTTP methods (GET, POST, PUT, DELETE)

Step 1: Test GET Requests (default)

Step 2: Test POST Requests

Step 3: Test Other Methods

---

Tutorial 8: SARIF Output for Ad Reporting

Scenario: You want to export CORS scan results in SARIF format for ad analysis and integration

Step 1: Understand SARIF Format
SARIF (Static Analysis Results Interchange Format) is an industry-standard format for security findings that enables integration with security tools and platforms.

Step 2: Generate SARIF Report

Step 3: Analyze Results

Step 4: Integration
SARIF files can be imported into security platforms and tools for centralized management and reporting. The generated SARIF file contains all necessary metadata including se, location, and detailed properties for comprehensi analysis.
---

📊 Output Explanation

Understanding the Results

[] (Green in terminal)

The ser with Access-Control-Allow-Origin: [origin] AND Access-Control-Allow-Credentials: true`

This is a real CORS

An attacker could exploit this

[SAFE] (Red in terminal)

The server did NOT respond with both required headers

Either the origin wasn't allowed OR credentials flag wasn't set

This bypass technique didn't work

Sample Output File

---

🤝 Contributing

We welcome contributions! Here's how you can help:

Report Issues

Found a bug? Have a feature request?

Visit:

Provide detailed description of the problem

Include example commands and output

Contribute Code

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Test thoroughly
5. Submit a pull request

---

Acknowledgment

Thanks to <a href=" for sharing the resources.

Thanks to <a href=" and the security researchers</a> for pro and collecting the test cases.

---

📄 License

This project is licensed under the MIT License - see LICENSE file for details.

---

👨‍💻 De

CorsOne is de and maintained by:

Mohammad Reza Omrani

- Twitter/X:
- LinkedIn: Mohammad Reza Omrani
- GitHub: omranisecurity

---

⭐ Support

If you find CorsOne helpful:

⭐ Star the repository on GitHub

🐛 Report bugs and suggest features

📢 Share with your security community

💬 Provide feedback and impro

---

📚 Additional Resources

CORS Security Documentation

OWASP CORS Documentation

MDN CORS Guide

CWE-942: Permissi Policy

What is CORS (cross-origin resource sharing)?

Learning Resources

PortSwigger - Cross-origin resource sharing (CORS)

---

Happy CORS Testing! 🛡️

For questions or support, visit the GitHub repository or contact the de.

项目信息

开发语言：Python

Star 数：29

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕CorsOne - Fast and comprehensive CORS misconfiguration scanner with 40+ bypass techniques and async scanning.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。