About CORScanner

CORScanner is a python tool designed to discover CORS misconfigurations vulnerabilities of websites. It helps website administrators and penetration testers to check whether the domains/urls they are targeting have insecure CORS policies.

Features

• Fast. It uses gevent instead of Python threads for concurrency, which is much faster for network scanning.
• Comprehensive. It covers all the common types of CORS misconfigurations we know.
• Flexible. It supports various self-define features (e.g. file output), which is helpful for large-scale scanning.
• 🆕 CORScanner supports installation via pip (

  pip install corscanner

  or

  pip install cors

  )
• 🆕 CORScanner can be used as a library in your project.

Two useful references for understanding CORS systematically: * USENIX security 18 paper: We Still Don’t Have Secure Cross-Domain Requests: an Empirical Study of CORS * 中文详解：绕过浏览器SOP，跨站窃取信息：CORS配置安全漏洞报告及最佳部署实践

@inproceedings{chen-cors,
author = {Jianjun Chen and Jian Jiang and Haixin Duan and Tao Wan and Shuo Chen and Vern Paxson and Min Yang},
title = {We Still Don{\textquoteright}t Have Secure Cross-Domain Requests: an Empirical Study of {CORS}},
booktitle = {27th {USENIX} Security Symposium ({USENIX} Security 18)},
year = {2018},
isbn = {978-1-939133-04-5},
address = {Baltimore, MD},
pages = {1079--1093},
url = {https://www.usenix.org/conference/usenixsecurity18/presentation/chen-jianjun},
publisher = {{USENIX} Association},
month = aug,
}

Screenshots

Installation

• Download this tool

  git clone https://github.com/chenjj/CORScanner.git
  

• Install dependencies

  sudo pip install -r requirements.txt
  

  CORScanner depends on the

  requests

  ,

  gevent

  ,

  tldextract

  ,

  colorama

  and

  argparse

  python modules.

Python Version:

• Both Python 2 (2.7.x) and Python 3 (3.7.x) are supported.

CORScanner as a library

• Install CORScanner via pip

sudo pip install corscanner

or use the short name:

sudo pip install cors

• Example code:

  python
  >>> from CORScanner.cors_scan import cors_check
  >>> ret = cors_check("https://www.instagram.com", None)
  >>> ret
  {'url': 'https://www.instagram.com', 'type': 'reflect_origin', 'credentials': 'false', 'origin': 'https://evil.com', 'status_code': 200}
  

You can also use CORScanner via the

corscanner

cors

cors -vu https://www.instagram.com

Usage

Examples

• To check CORS misconfigurations of specific domain:

python cors_scan.py -u example.com

• To enable more debug info, use -v:

python cors_scan.py -u example.com -v

• To save scan results to a JSON file, use -o:

python cors_scan.py -u example.com -o output_filename

• To check CORS misconfigurations of specific URL:

python cors_scan.py -u http://example.com/restapi

• To check CORS misconfiguration with specific headers:

python cors_scan.py -u example.com -d "Cookie: test"

• To check CORS misconfigurations of multiple domains/URLs:

python cors_scan.py -i top_100_domains.txt -t 100

• To enable proxy for CORScanner, use -p

python cors_scan.py -u example.com -p http://127.0.0.1:8080

To use socks5 proxy, install PySocks with

pip install PySocks

python cors_scan.py -u example.com -p socks5://127.0.0.1:8080

• To list all the basic options and switches use -h switch:

python cors_scan.py -h

Misconfiguration types

This tool covers the following misconfiguration types:

Access-Control-Allow-Origin headers

wwww.example.com

example.com.evil.com

wwww.example.com

evilexample.com

wwww.example.com

wwwaexample.com

wwww.example.com

example.co

wwww.example.com

null

github.io

Welcome to contribute more.

Exploitation examples

Here is an example about how to exploit "Reflectanyorigin" misconfiguration on Walmart.com(fixed). Localhost is the malicious website in the video.

Walmart.com video on Youtube:

Here is the exploitation code: ```javascript ```

If you have understood how the demo works, you can read Section 5 and Section 6 of the CORS paper and know how to exploit other misconfigurations.

License

CORScanner is licensed under the MIT license. take a look at the LICENSE for more information.

Credits

This work is inspired by the following excellent researches:

• James Kettle, “Exploiting CORS misconfigurations for Bitcoins and bounties”, AppSecUSA 2016*
• Evan Johnson, “Misconfigured CORS and why web appsec is not getting easier”, AppSecUSA 2016*
• Von Jens Müller, "CORS misconfigurations on a large scale", CORStest*